www.zdnet.com Open in urlscan Pro
199.232.194.154  Public Scan

7 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 121

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

120 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/	262 KB 95 KB	524ms 496ms	Document text/html	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 7ca10075d29b8a139acb424d933fc76cd73279cba7841f2d3f40005d32390424 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.zdnet.com :scheme https :path /article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" last-modified Thu, 07 Oct 2021 05:29:48 GMT link <https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css>; rel="preload"; as="style"; nopush referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id 82d16e52-56ea-44ec-a4be-dd4410fe651b x-xss-protection 1; mode=block date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish cache-control max-age=5400, private expires Thu, 07 Oct 2021 06:59:48 GMT set-cookie fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure; strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 96473
GET H2	200	main-0daad712ac-rev.css www.zdnet.com/a/fly/css/core/	318 KB 53 KB	7ms 7ms	Stylesheet text/css	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7b23034d527a877853e9e8cca75bb4e7b9e312e0b3e53a6ef4195c7181423e7b Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/css/core/main-0daad712ac-rev.css pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 54341 x-xss-protection 1; mode=block last-modified Wed, 06 Oct 2021 14:52:36 GMT server ContentServer x-frame-options SAMEORIGIN etag "b00dfe44d3820cbb7aa48db9a98339fa" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 13 Oct 2021 14:54:47 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	43ms 26ms	Script application/javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 BC5xsXKGgJbQbCzkLNvwBQ== age 86411 vary Accept-Encoding content-length 6328 x-ms-lease-status unlocked last-modified Wed, 04 Aug 2021 01:49:58 GMT server cloudflare etag 0x8D956EA2A6E73F4 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b8d637e9-f01e-012a-80bd-8bebf6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 69a4bbe23c83c2a9-FRA expires Thu, 07 Oct 2021 09:29:49 GMT
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/privacy/optanon/optanon-v1.1.0.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Thu, 16 Sep 2021 06:24:26 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame D1F1	205 KB 50 KB	38ms 9ms	Script application/javascript	104.111.214.229 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.111.214.229 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-214-229.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding br Last-Modified Thu, 02 Sep 2021 17:15:04 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	headshot-2.jpg www.zdnet.com/a/img/resize/db1fbfa20f20d6ec934b367bb5d65c477ca96322/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/	494 B 841 B	7ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/db1fbfa20f20d6ec934b367bb5d65c477ca96322/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=40&height=40&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e30c76f858a7b664fb4a979a1fab01b87e94db5bbe0738c924743351eb6f8309 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/db1fbfa20f20d6ec934b367bb5d65c477ca96322/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=40&height=40&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=28670 idim=280x280 ifmt=jpeg ofsz=494 odim=40x40 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638183284258 fastly-stats io=1 content-length 494 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "5ehXvyI8nHyG7yjUuEpxeUyYO+pDZF5/npfFViQJry8" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Sun, 26 Sep 2021 22:52:45 GMT
GET H2	200	2020-03-18-at-12-23-32-pm.jpg www.zdnet.com/a/img/resize/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d/2020/03/18/7c2e2258-7566-4e66-9059-a1a8aedf00b4/	4 KB 5 KB	7ms 7ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d/2020/03/18/7c2e2258-7566-4e66-9059-a1a8aedf00b4/2020-03-18-at-12-23-32-pm.jpg?width=220&height=165&fit=bounds&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash dac7f77e8f8d62e6ff2ebb7fa1a77a719fc6c8beb3a28c51f732b6b6c0ce17a1 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d/2020/03/18/7c2e2258-7566-4e66-9059-a1a8aedf00b4/2020-03-18-at-12-23-32-pm.jpg?width=220&height=165&fit=bounds&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=105669 idim=1642x1096 ifmt=jpeg ofsz=4578 odim=220x147 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599085316373399 fastly-stats io=1 vary Accept-Encoding, Accept content-length 4578 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "EYD+MTccJhCUsUmnK78CInjnMf9vFiT5s71uUkjD1qA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Thu, 16 Sep 2021 14:47:32 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/libs/require-2.1.2.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1633120131828177 vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Fri, 01 Oct 2021 21:00:13 GMT server ContentServer x-frame-options SAMEORIGIN etag "aa5a2831cd4647aa8442457ee1f6b482" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 11 Oct 2021 15:00:23 GMT
GET H2	200	mag-white01.png www.zdnet.com/a/fly/1633531776-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	6ms 6ms	Image image/png	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1633531776-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1633531776-asset/bundles/zdnetcss/images/core/mag-white01.png pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 1265 x-xss-protection 1; mode=block last-modified Wed, 06 Oct 2021 14:30:04 GMT server ContentServer x-frame-options SAMEORIGIN date Thu, 07 Oct 2021 05:29:49 GMT strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Oct 2021 14:33:07 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1633531776-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	6ms 6ms	Image image/png	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1633531776-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1633531776-asset/bundles/zdnetcss/images/core/logo.png pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-0daad712ac-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1633526133839452 vary Accept-Encoding, Accept content-length 4105 x-xss-protection 1; mode=block last-modified Wed, 06 Oct 2021 14:00:13 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 13 Oct 2021 14:29:39 GMT
GET H2	200	Regular.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 6ms	Font font/woff2	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Mon, 13 Sep 2021 08:18:41 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 15:00:25 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 6ms	Font font/woff2	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Mon, 13 Sep 2021 08:18:41 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 15:00:26 GMT
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/8681d6-fly/js/	222 KB 70 KB	7ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/8681d6-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bdf24fc968e5e7fb17888303cd0580734f2c046308a89b0d8967b61a7dcb74ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/8681d6-fly/js/main.default.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 71430 x-xss-protection 1; mode=block last-modified Wed, 06 Oct 2021 14:52:26 GMT server ContentServer x-frame-options SAMEORIGIN etag "d10d7d01cc23999e2da04a17b8fbcb83" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 13 Oct 2021 14:54:47 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	33ms 15ms	XHR application/x-javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 4134 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6b7a330a-601e-004d-2d15-b61e04000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 69a4bbe2dc994401-FRA
GET H2	200	nr-spa-1210.min.js Show response js-agent.newrelic.com/	41 KB 16 KB	35ms 7ms	Script application/javascript	151.101.66.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1210.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ae2fc8f8e0697701399521441a03445a3c11d79719accd0099f41687c1536c49 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id S2ZWAVF_bOLxH9dSP4fxyD9xCbMCwnq9 content-encoding gzip etag "d5eff122d09ab2c851fb1780f0287cbf" x-amz-request-id WX0V4HYCNZMQF8V1 x-cache HIT cross-origin-resource-policy cross-origin content-length 15563 x-amz-id-2 V3NWDRAGc9SgNVtEBWiiDcINCoTerPj471IMrsQhETN32n9I20g9CtqBNYipCh1nBoNnp81FM40= x-served-by cache-fra19169-FRA last-modified Tue, 22 Jun 2021 22:47:08 GMT server AmazonS3 x-timer S1633584589.291701,VS0,VE0 date Thu, 07 Oct 2021 05:29:49 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 3434
GET H2	200	bidbarrel-zdnet-rv.min.js Show response at.adtech.redventures.io/lib/dist/prod/	601 KB 601 KB	33ms 7ms	Script application/javascript	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash a448f4df2477b69e6afb93be29aa2d752076fa18c23f5421c13dc5a76b3e70a0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 06a27d66e25d02ebcfb014b9d194016b.cloudfront.net (CloudFront), 1.1 varnish age 237 x-cache Miss from cloudfront, HIT content-length 615156 x-served-by cache-hhn4044-HHN last-modified Wed, 08 Sep 2021 13:53:12 GMT server AmazonS3 x-timer S1633584589.293224,VS0,VE1 etag "656910910e572ade18633ae4183df843" vary Accept-Encoding, Origin content-type application/javascript cache-control max-age=900, public, must-revalidate x-amz-cf-pop FRA60-P1 accept-ranges bytes x-amz-cf-id z_Bryt2hT2iCqc8cMgakH8DCzbXk_85xVPRnzCEeHZWKjv4EJBA1zA== x-cache-hits 1
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	193 B 398 B	39ms 18ms	Script text/javascript	104.20.184.68 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.184.68 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 60756645bbed6ad3cc3e8be0a057dff15132f22b5b60cbe14e48250980043653 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 69a4bbe318a72c4e-FRA
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	170ms 124ms	Script application/javascript	34.120.203.121 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 121.203.120.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 google last-modified Tue, 12 Jan 2021 17:00:48 GMT etag "5ffdd5c0-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	mpulse-1.0.2.js Show response www.zdnet.com/a/fly/js/libs/	61 KB 12 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/libs/mpulse-1.0.2.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632932006885944 vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 17:00:15 GMT server ContentServer x-frame-options SAMEORIGIN etag "afd9ca473961e1e2722946e2315b9644" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 07 Oct 2021 09:46:11 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame D1F1	2 KB 1 KB	180ms 166ms	XHR application/json	104.111.214.229 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5445282&v=1.720.0&if=&sl=0&si=b4e71b2f-b8b4-44bc-be4c-69985165e527-r0ldxp&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.111.214.229 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-214-229.deploy.static.akamaitechnologies.com Software / Resource Hash 4adb45c49512018b41f6523f445f0decb5fc7670168c41ec108208580091d273 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 864
GET H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/1/	49 B 930 B	146ms 129ms	Script text/javascript	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1210.e2a3f80&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=710&ck=1&ref=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/&ap=247&be=548&fe=667&dc=577&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1633584588594,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:14,%22c%22:14,%22s%22:19,%22ce%22:29,%22rq%22:29,%22rp%22:525,%22rpe%22:535,%22dl%22:528,%22di%22:577,%22ds%22:577,%22de%22:577,%22dc%22:666,%22l%22:666,%22le%22:669%7D,%22navigation%22:%7B%7D%7D&fp=631&fcp=631&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC X-NewRelic-App-Data PxQGQlRaAAsCV1BXFR0VMQFTYkEDCBADUxZRDVZkG3xWEU0YdQhAEgVCVAkDEWQcfgEVFk51XhUUUEJQCgMRQBxSFlIUChoAC1MLVXRMB05WAhtDUVAOVVQGWFQGVQUEVAQPCkBKBQNcEV0/ Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 69a4bbe34d110614-FRA
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	224ms 212ms	XHR application/json	104.111.214.229 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1633584589314&s=ffad063398d3c58bc9c7d71215167db57480392ca0ecf4e7bf10fe7accd0e360 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.111.214.229 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-214-229.deploy.static.akamaitechnologies.com Software / Resource Hash 04e6681816cb49c7b83377bad2e5628954b89e709b5540893c51e4ee49f7b41f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 871
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	14ms 13ms	Script application/javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 8794732 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Thu, 24 Jun 2021 12:22:20 GMT server cloudflare etag 0x8D9370AB6896F5E expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1e85a95a-b01e-0126-433f-6b0507000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 69a4bbe33dc0c2a9-FRA expires Fri, 15 Oct 2021 05:29:49 GMT
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	131ms 118ms	Preflight text/html	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context 92ba2e08b330828d965eca0c471c8612 server Google Frontend accept-ranges bytes date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-served-by cache-hhn4057-HHN x-cache MISS x-cache-hits 0 x-timer S1633584589.385018,VS0,VE112 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	90 KB 23 KB	28ms 6ms	Script text/javascript	151.101.65.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.65.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 682121d0deac61377b17b153c741837785e4cdbd4bf71dc1ec6e3e60b59ea1e0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding gzip Age 2120 X-Cache HIT Connection keep-alive Content-Length 23165 x-amz-id-2 A7qR4qB3NdePae7Lz+uVdsnmBjKqu8EzWpCyylT/dxleaGZ8ods2OVZdGsGSWRAvzyQoHRy8tJ4= X-Served-By cache-hhn4033-HHN Last-Modified Thu, 07 Oct 2021 03:41:54 GMT Server AmazonS3 X-Timer S1633584589.372700,VS0,VE0 ETag "bcb60902a5c36531e706b38a723e7510" x-amz-request-id MF9ZJ5Z7SH162QXC Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 70
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	4 KB 789 B	6ms 6ms	Fetch application/json	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash a3ae124a6225faa27dd28106b9d57d04b45a60eb1bb18e0c4a4ea5f7ca87dade Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers cat topoc29B3 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Accept application/json Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d variant core version rv2.25.2 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 609 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 604 x-xss-protection 1; mode=block x-served-by cache-hhn4057-HHN access-control-allow-origin * server Google Frontend x-timer S1633584590.503523,VS0,VE1 x-frame-options SAMEORIGIN date Thu, 07 Oct 2021 05:29:49 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context 6cd685175b0d52398738a48e693024d6 cache-control max-age=900 etag W/1bd818c7861f59e22987974dd8b9f9b2bf56545a accept-ranges bytes access-control-allow-headers * x-cache-hits 1
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	74 KB 26 KB	37ms 15ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software sffe / Resource Hash 4c3b589a415e252117f9441ad156569dbb1dfeb7f00d18b01e805040a30e161d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1008 / 932 of 1000 / last-modified: 1633558131" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 25852 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 07 Oct 2021 05:29:49 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	17ms 17ms	Fetch application/x-javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 3401 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 04e26c27-701e-00bc-7615-b6cf97000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 69a4bbe3be414401-FRA
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gptprebidnative/202110061145/	178 KB 57 KB	6ms 6ms	Script application/javascript	151.101.65.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202110061145/wrap.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.65.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 33398a24ac6533f6e595d29498b0e3933723b59b54d03669d3b8f152b938f848 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 07 Oct 2021 05:29:49 GMT Content-Encoding gzip Age 175 X-Cache HIT Connection keep-alive Content-Length 58113 x-amz-id-2 wZedG5eawYMZJovEr12jHuzYFyv7WXlks9wU3Xm/jBV+3FSM9kt7xD8Cn/obhYuYlGYV0/+STxI= X-Served-By cache-hhn4033-HHN Last-Modified Wed, 06 Oct 2021 15:49:37 GMT Server AmazonS3 X-Timer S1633584589.396513,VS0,VE0 ETag "8c643d08bb28387e3f2205c9fea7652b" x-amz-request-id 8HRCB4DK48MNWBXB Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 519
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	12ms 12ms	Fetch application/json	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 3814950 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id a62ea5e0-601e-004d-2289-981e04000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 69a4bbe3fea34401-FRA expires Fri, 15 Oct 2021 05:29:49 GMT
GET H2	200	pubads_impl_2021092301.js Show response securepubads.g.doubleclick.net/gpt/	338 KB 119 KB	15ms 14ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software sffe / Resource Hash d7f36354b34b6689975a55773065d0b9dc7ab48ef63ee6e8bb68f199bf7debbd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 121150 x-xss-protection 0 last-modified Thu, 23 Sep 2021 08:34:35 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 07 Oct 2021 05:29:49 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	30ms 16ms	XHR application/json	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Thu, 07 Oct 2021 05:29:49 GMT
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	76 KB 21 KB	33ms 7ms	Script text/javascript	18.66.139.25 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.25 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash c73d1cccad89a1fe458c20addec700f217f6859a285bd6673d2c726119e9e953 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip etag W/"6befeb6cf0e01f44fcb4ad747ed6a8df" last-modified Thu, 30 Sep 2021 12:03:36 GMT server AmazonS3 age 62750 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) date Wed, 06 Oct 2021 12:04:00 GMT x-amz-cf-pop FRA60-P4 x-amz-cf-id lpoAl2BkWKfc-toG6fXvbzi-Ub85iAeHbw9dSTJWloSYmFhiOm0W0Q==
GET H2	200	moatheader.js Show response z.moatads.com/redventuresgamheader644747280705/	239 KB 82 KB	31ms 8ms	Script application/x-javascript	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash c7d23011a3e60db63156ffc0217b92c15daee077aafc3d92696796363e63e017 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip last-modified Tue, 21 Sep 2021 16:25:08 GMT server AmazonS3 x-amz-request-id 33G64NF244BT0D3Z etag "8643c11e35bc6bd7d41b47ab6a859bc5" vary Accept-Encoding content-type application/x-javascript cache-control max-age=34101 accept-ranges bytes content-length 83232 x-amz-id-2 TZo8xetmZG4e7XoF6T18MKS3k4e2A/WlEJXTdSpshLYapzauyOXw7RsYdsAfhjiudn+2z1Sb3gI=
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 570 B	76ms 28ms	Script application/javascript	172.217.23.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS mil04s23-in-f98.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	166 KB 29 KB	612ms 612ms	XHR text/plain	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1914870193910310&correlator=40768209465180&output=ldjh&impl=fifs&eid=31060544&vrg=2021092301&ptt=17&sc=1&sfv=1-0-38&ecs=20211007&iu_parts=22309610186%2Caw-zdnet%2Cblackberry&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x66%7C5x5%2C300x250%7C300x600%2C300x250%2C300x250%2C728x90%7C970x250%7C970x66&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529%257Cpv%253D1%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529%257Cpv%253D1%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529%257Cpv%253D1%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%26iid%3Dunit%253Dmpu-bottom%257Cvguid%253Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529%257Cpv%253D1%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000%26iid%3Dunit%253Dleader-plus-bottom%257Cvguid%253Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529%257Cpv%253D1&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dblackberry%252Cchina%252Cgovernment-asia%252Csecurity%252Cindia%252Cgovernment%26pid%3Drim-blackberry-series%252Crim-blackberry%252Cmicrosoft-onedrive%252Cmicrosoft-teams%252Ctargus-strike%252Ccobalt%252Ckoss-cobalt%252Clogitech-powershell%26mfr%3Dblackberry%252Cfireeye%252Cmicrosoft%252Ccobalt-networks-inc%26tag%3Dblackberry%252Ccyber-security%252Cmicrosoft%252Cmalware%26prodtype%3Dblackberry%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D4%26session%3Dc%26pv%3D1%26ftag%3Dtre21e7bbc%26vguid%3Dc59bf21f-efc6-4bb5-a8a7-d65e9b734529&cookie_enabled=1&bc=31&abxe=1&lmt=1633584588&dt=1633584589738&dlt=1633584589122&idt=549&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C1050%2C1050%2C1050%2C436&adys=50%2C505%2C1731%2C2363%2C4101&adks=3178501361%2C2384101467%2C2440909019%2C2500720353%2C3770109282&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100%7C370x280%7C370x30%7C370x250%7C1210x0&msz=1600x100%7C370x30%7C370x30%7C370x30%7C1210x0&ga_vid=1730250992.1633584590&ga_sid=1633584590&ga_hid=1475762975&ga_fc=false&fws=4%2C4%2C4%2C4%2C4&ohw=1600%2C370%2C370%2C370%2C1600&btvi=0%7C0%7C1%7C2%7C3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0. Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash 006e6aa6e640b08b66bad84730ab56f0c43f2c1bd23ed3c17e6367c2aceb009a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29775 x-xss-protection 0 google-lineitem-id 5792314687,5792314687,5783219911,-1,-1 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138366997288,138366996265,138362955961,-1,-1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response 24912c9ac3937893745269dd41afa941.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CF16	6 KB 4 KB	77ms 15ms	Document text/html	142.250.185.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://24912c9ac3937893745269dd41afa941.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f1.1e100.net Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 24912c9ac3937893745269dd41afa941.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-38/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Thu, 07 Oct 2021 05:29:49 GMT expires Fri, 07 Oct 2022 05:29:49 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	304ms 98ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	300ms 98ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	299ms 99ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	297ms 97ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	108ms 106ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 14673f3587952d6036e85766f8acec953a75b98f02834ed9b203217ff4919223 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	110ms 108ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash c36021faefa18853da420c8b991c3864f3207e9cba4caf884213eef77da86271 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	137 B 270 B	110ms 108ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 028e0ff1dc8cc4722c3889fa79027be0c75fe45355a8a2f7d10e4a778de5c7f7 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 137 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	114ms 112ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 6036c58633b8a2dcf744f947d1232b2228071e46783c9208d6df50320f9b7a9f Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	xs1.html Show response cdn.cohesionapps.com/cohesion/ Frame 21AB	2 KB 1 KB	8ms 8ms	Document text/html	18.66.139.25 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs1.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.25 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9 Request headers :method GET :authority cdn.cohesionapps.com :scheme https :path /cohesion/xs1.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Response headers content-type text/html last-modified Thu, 30 Sep 2021 12:03:36 GMT x-amz-server-side-encryption AES256 x-amz-version-id null server AmazonS3 content-encoding gzip date Wed, 06 Oct 2021 21:24:03 GMT etag W/"10b2c1751c2247b1aeccc91060f971cf" vary Accept-Encoding x-cache Hit from cloudfront via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id hQwS14iDINYuo0O4x35bmG2Nqn3tmXKidTglhruEoO54M0CoJ2ow7g== age 29147
GET H2	200	article-8fb3253bd8-rev.js Show response www.zdnet.com/a/fly/js/pages/	103 KB 26 KB	8ms 8ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/pages/article-8fb3253bd8-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7e94090f0cfc709f08fae56e965306d7822cf8e92912520a529e34c252ef3817 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/pages/article-8fb3253bd8-rev.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 26925 x-xss-protection 1; mode=block last-modified Wed, 06 Oct 2021 13:15:05 GMT server ContentServer x-frame-options SAMEORIGIN etag "3cab3a0428ff81e7baa1c965305f6ca0" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 13 Oct 2021 13:17:17 GMT
GET H/1.1	204 No Content	/ Show response 1737ad5b.akstat.io/	0 354 B	228ms 198ms	XHR image/gif	104.111.214.229 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://1737ad5b.akstat.io/?h.pg=article&when=1633584589796&cdim.Site_View=desktop&t_other=custom4%7C529&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=7cc5bad2900294104127c1f6c3f2b788ead81d5c-77f98978-800602a4&h.t=1633584589427&http.initiator=api&rt.start=api&rt.si=79238c86-c228-47ea-85be-e6d73dfe39df&rt.ss=1633584590034&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.111.214.229 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-214-229.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Thu, 07 Oct 2021 05:29:50 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Thu, 07 Oct 2021 05:29:50 GMT
POST H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/events/1/	24 B 501 B	133ms 132ms	XHR image/gif	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1210.e2a3f80&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=1220&ck=1&ref=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 content-type text/plain Response headers Date Thu, 07 Oct 2021 05:29:49 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com access-control-allow-credentials true Connection keep-alive CF-Ray 69a4bbe6598c0614-FRA Content-Length 24
GET H2	200	v2 Show response mb.moatads.com/yi/	255 B 430 B	106ms 33ms	Script text/html	18.169.85.185 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-mK3eZQwprWHiKYvbY%2BOEbHHfl7P4J7uhfDBJf6raYEJYmkDpFPmliBNlAlwWxmRnpyWz&rs=1-tkHTYX5EcQEJWg%3D%3D&sc=1&os=1-5w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&pcode=redventuresgamheader644747280705&callback=MoatNadoAllJsonpRequest_89693567 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.169.85.185 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-169-85-185.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 4c801ff55c70a3d9ca7d358433cf9a8d781aff13f8176d84cd242c3e2332ceda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "59b252fcc438b0557b4a4492f4b6607eba72eead" content-length 255 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	112 B 288 B	92ms 25ms	Script text/html	18.134.72.135 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-mK3eZQwprWHiKYvbY%2BOEbHHfl7P4J7uhfDBJf6raYEJYmkDpFPmliBNlAlwWxmRnpyWz&rs=1-tkHTYX5EcQEJWg%3D%3D&sc=1&os=1-5w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1633584589817&de=349656855819&rx=775156688276&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=1&cb=0&cu=1633584589817&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A631%3A631%3A669%3A577&jk=-1&jm=-1&fs=194656&na=315788872&cs=0&ord=1633584589817&jv=870845653&callback=DOMlessLLDcallback_89693567 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.72.135 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-72-135.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 1944d3f1c7e0745993e4292d49c8adc0e43fe611afcd85a3124727bc349fbf6b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "d76d81a98d063574d18a6d46ad9823cb098c7265" content-length 112 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	114 B 288 B	93ms 25ms	Script text/html	18.134.72.135 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-mK3eZQwprWHiKYvbY%2BOEbHHfl7P4J7uhfDBJf6raYEJYmkDpFPmliBNlAlwWxmRnpyWz&rs=1-tkHTYX5EcQEJWg%3D%3D&sc=1&os=1-5w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1633584589817&de=349656855819&rx=775156688276&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=2&cb=0&cu=1633584589817&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A631%3A631%3A669%3A577&jk=-1&jm=-1&fs=194656&na=397943207&cs=0&callback=MoatDataJsonpRequest_89693567 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.72.135 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-72-135.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 92a2f9936f88396d557e2cc40432e2867f74afb95c8b86615ab7523e36a174d7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "83ea12fb6207282334649563e1db3978fd42d0a8" content-length 114 content-type text/html; charset=UTF-8
GET H2	200	xs2.html Show response cdn.cohesionapps.com/cohesion/ Frame 21AB	473 B 836 B	7ms 7ms	Document text/html	18.66.139.25 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs2.html Requested by Host: cdn.cohesionapps.com URL: https://cdn.cohesionapps.com/cohesion/xs1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.25 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9 Request headers :method GET :authority cdn.cohesionapps.com :scheme https :path /cohesion/xs2.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest iframe referer https://cdn.cohesionapps.com/cohesion/xs1.html accept-encoding gzip, deflate, br cookie cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://cdn.cohesionapps.com/cohesion/xs1.html Response headers content-type text/html content-length 473 last-modified Thu, 30 Sep 2021 12:03:36 GMT x-amz-server-side-encryption AES256 x-amz-version-id null accept-ranges bytes server AmazonS3 date Wed, 06 Oct 2021 18:20:03 GMT etag "ffa03bed298484a7755ca23c5431cb28" x-cache Hit from cloudfront via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id NJWSPTEC2M7h_TWAIhFH9IK2MWyxNKal3RsKfNDhYVdZGD7jMzO4aA== age 40187
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 1 KB	115ms 114ms	XHR application/json	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash baca0050b39a57da4e8c99cf230d546893957478e38191afa05599324d89c677 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br tracestate 78034@nr=0-1-2767451-695782612-cb3f0bdbfe1eff9a----1633584589939 accept-language de-DE,de;q=0.9 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiY2IzZjBiZGJmZTFlZmY5YSIsInRyIjoiODVlZDJkM2Y1ZGU0ZTBhOTk3NTllNTAyZmU0NzA2OTAiLCJ0aSI6MTYzMzU4NDU4OTkzOSwidGsiOiI3ODAzNCJ9fQ== sec-fetch-dest empty x-requested-with XMLHttpRequest cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 :path /components/breaking-news/xhr/?slug=breaking-news-banner pragma no-cache x-newrelic-id VgEBVlJWCRAGXVRVDwMDUlc= traceparent 00-85ed2d3f5de4e0a99759e502fe470690-cb3f0bdbfe1eff9a-01 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept application/json, text/javascript, */*; q=0.01 cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-cb3f0bdbfe1eff9a----1633584589939 traceparent 00-85ed2d3f5de4e0a99759e502fe470690-cb3f0bdbfe1eff9a-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiY2IzZjBiZGJmZTFlZmY5YSIsInRyIjoiODVlZDJkM2Y1ZGU0ZTBhOTk3NTllNTAyZmU0NzA2OTAiLCJ0aSI6MTYzMzU4NDU4OTkzOSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff last-modified Thu, 07 Oct 2021 05:08:29 GMT vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgVYU1cUHgFIQwFWU1RTBlUBUFFUUwYAAQ9AFF5VXkAAZA== x-frame-options SAMEORIGIN date Thu, 07 Oct 2021 05:29:50 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 9182f3b3-9a9c-435c-9b13-53138b37b4aa content-type application/json via 1.1 varnish cache-control max-age=5400, private accept-ranges bytes expires Thu, 07 Oct 2021 06:38:29 GMT
GET H2	200	my-finance-widget-7aae3015cd-rev.js Show response www.zdnet.com/a/fly/js/components/	703 B 651 B	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/my-finance-widget-7aae3015cd-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a84086788b252354921398e522c3afd599306017c370cdcbc5827b6deaa7e1da Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/my-finance-widget-7aae3015cd-rev.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632932011140657 vary Accept-Encoding, Accept content-length 421 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 17:00:12 GMT server ContentServer x-frame-options SAMEORIGIN etag "4be566cfa2472e80be8cf4b59f863e9b" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 07 Oct 2021 06:32:18 GMT
GET H2	200	disqus-loader-891338aca1-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 840 B	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/disqus-loader-891338aca1-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bb852945d8e9ae2dddadccfbce542830d5e86adf940a29239fa2742d6e79e2fb Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/disqus-loader-891338aca1-rev.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1633361026007085 vary Accept-Encoding, Accept content-length 685 x-xss-protection 1; mode=block last-modified Mon, 04 Oct 2021 16:00:13 GMT server ContentServer x-frame-options SAMEORIGIN etag "005254acc6d1010354867bc3ee9a0a20" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 12 Oct 2021 00:51:58 GMT
GET H2	200	158214905.jpg www.zdnet.com/a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/	5 KB 5 KB	7ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/158214905.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ad845230e13fc3c71a97f0c7495040d60dfd982906e4d969c0b406c64edc4c74 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/158214905.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=80340 idim=830x553 ifmt=jpeg ofsz=4936 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599095685127300 fastly-stats io=1 vary Accept-Encoding, Accept content-length 4936 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Wtl/PR+R7FjlpzayRq+01bR8kfqAjwLS/5Mansv16N8" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Wed, 06 Oct 2021 16:28:35 GMT
GET H2	200	screenshot-2019-01-14-at-10-59-58.png www.zdnet.com/a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/	18 KB 18 KB	8ms 7ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/screenshot-2019-01-14-at-10-59-58.png?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 58d681ed4544548acfea6397754419c264d0b3b91e801ee0528fd12b419f5119 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/screenshot-2019-01-14-at-10-59-58.png?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=862371 idim=1440x1046 ifmt=png ofsz=18272 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588637848967121 fastly-stats io=1 content-length 18272 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Vr/Ary///UXr0Ia+QCRvkMFStiD/raqFtqgzVlMPaTM" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Wed, 06 Oct 2021 16:23:10 GMT
GET H2	200	shutterstock-1504791845.jpg www.zdnet.com/a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/	4 KB 4 KB	8ms 7ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/shutterstock-1504791845.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f769e41a7be0127e78da920250fa4b4cc9e708f3c114b39deeadfa9ba13c0608 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/shutterstock-1504791845.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=122533 idim=1600x1069 ifmt=jpeg ofsz=3916 odim=170x128 ofmt=webp fastly-stats io=1 vary Accept-Encoding, Accept content-length 3916 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "lalCTldvN1TivK7Uw5FKio6JqCtI30EMw6MlfurGPvI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 01 Oct 2021 00:00:20 GMT
GET H2	200	google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg www.zdnet.com/a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/	5 KB 5 KB	8ms 7ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 80af30a842056c66eedf65db2284e47e4d933d0fd6e704f582c0c93dc205f6d1 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=47585 idim=960x540 ifmt=jpeg ofsz=4630 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638101261013 fastly-stats io=1 content-length 4630 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "UYu3uqvOWz8TMuGFmYIrdaFAno5NX2ixswQIp49+2QA" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Tue, 05 Oct 2021 21:20:40 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	157ms 155ms	XHR application/json	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=blackberry Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 580a56e2e8fea00a8363225bf0bffd94ca9182f18b2d06d8a714ac46b67c2690 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br tracestate 78034@nr=0-1-2767451-695782612-b9b009897d3c5c0c----1633584589950 accept-language de-DE,de;q=0.9 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiYjliMDA5ODk3ZDNjNWMwYyIsInRyIjoiZWVjY2ZmN2M5ZmQzOTY2Y2JkMzdlY2FhZGZjZjEzMDAiLCJ0aSI6MTYzMzU4NDU4OTk1MCwidGsiOiI3ODAzNCJ9fQ== sec-fetch-dest empty x-requested-with XMLHttpRequest cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 :path /newsletter/xhr/widget-login/?topic=blackberry pragma no-cache x-newrelic-id VgEBVlJWCRAGXVRVDwMDUlc= traceparent 00-eeccff7c9fd3966cbd37ecaadfcf1300-b9b009897d3c5c0c-01 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept application/json, text/javascript, */*; q=0.01 cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-b9b009897d3c5c0c----1633584589950 traceparent 00-eeccff7c9fd3966cbd37ecaadfcf1300-b9b009897d3c5c0c-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiYjliMDA5ODk3ZDNjNWMwYyIsInRyIjoiZWVjY2ZmN2M5ZmQzOTY2Y2JkMzdlY2FhZGZjZjEzMDAiLCJ0aSI6MTYzMzU4NDU4OTk1MCwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IAAJdU04aABtEUlJTVgcDAgcFAAtVCgFRVhFJXwBdElY/ x-frame-options SAMEORIGIN date Thu, 07 Oct 2021 05:29:50 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 7f697a22-8d0c-4b21-8871-2b14de38fbd1 content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private set-cookie fly_session=56ed6e2bfae4c3abc373bc54fa107421; path=/; domain=.zdnet.com; secure; HttpOnly accept-ranges bytes expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	front-door-carousel-dcdcc78ebc-rev.js Show response www.zdnet.com/a/fly/js/components/	5 KB 2 KB	7ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632932010934594 vary Accept-Encoding, Accept content-length 1651 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 17:00:15 GMT server ContentServer x-frame-options SAMEORIGIN etag "c294ce230b43716501135dc77a8a4c54" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 07 Oct 2021 06:22:05 GMT
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	99ms 97ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	110ms 107ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash bb31fdd29303987a820f68be6b35d84b8bf2347447c76a267d18925b7fec455f Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	109ms 107ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash c9f25d6e2ef11dc0a788917201739e7223a5dd08220ebb5dced2f6f20b8178a5 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	99ms 98ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
GET H2	200	158214905.jpg www.zdnet.com/a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/	5 KB 5 KB	6ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/158214905.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/8681d6-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ad845230e13fc3c71a97f0c7495040d60dfd982906e4d969c0b406c64edc4c74 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/2c3190222bfd15bf04834a9c9279b0d583cce26e/2018/02/07/c42efd4f-479f-49c2-bd3f-8f6ac6bb0db0/158214905.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=80340 idim=830x553 ifmt=jpeg ofsz=4936 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599095685127300 fastly-stats io=1 vary Accept-Encoding, Accept content-length 4936 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Wtl/PR+R7FjlpzayRq+01bR8kfqAjwLS/5Mansv16N8" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Wed, 06 Oct 2021 16:28:35 GMT
GET H2	200	screenshot-2019-01-14-at-10-59-58.png www.zdnet.com/a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/	18 KB 18 KB	6ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/screenshot-2019-01-14-at-10-59-58.png?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/8681d6-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 58d681ed4544548acfea6397754419c264d0b3b91e801ee0528fd12b419f5119 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/de04e16d83c6d8e87130ec126dc1859b14e099c5/2019/01/14/825b8587-f067-4e05-ab87-9549a743ba58/screenshot-2019-01-14-at-10-59-58.png?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=862371 idim=1440x1046 ifmt=png ofsz=18272 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588637848967121 fastly-stats io=1 content-length 18272 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Vr/Ary///UXr0Ia+QCRvkMFStiD/raqFtqgzVlMPaTM" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Wed, 06 Oct 2021 16:23:10 GMT
GET H2	200	shutterstock-1504791845.jpg www.zdnet.com/a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/	4 KB 4 KB	6ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/shutterstock-1504791845.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/8681d6-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f769e41a7be0127e78da920250fa4b4cc9e708f3c114b39deeadfa9ba13c0608 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/09efe608b8959e08de68ba22afacf72c0b3d76eb/2021/07/29/328ebbca-0812-4d74-8a88-a3aa8b815b5f/shutterstock-1504791845.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=122533 idim=1600x1069 ifmt=jpeg ofsz=3916 odim=170x128 ofmt=webp fastly-stats io=1 vary Accept-Encoding, Accept content-length 3916 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "lalCTldvN1TivK7Uw5FKio6JqCtI30EMw6MlfurGPvI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 01 Oct 2021 00:00:20 GMT
GET H2	200	google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg www.zdnet.com/a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/	5 KB 5 KB	6ms 6ms	Image image/webp	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/8681d6-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 80af30a842056c66eedf65db2284e47e4d933d0fd6e704f582c0c93dc205f6d1 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/img/resize/fba26e67b43145aca7a2a33d520f2794cb18c733/2019/08/19/6f985463-ce3f-4e51-9d74-8693f869a8a3/google-to-android-users-no-passwords-you-5d55586bbac36000019f86db-1-aug-19-2019-21-14-36-poster.jpg?width=170&height=128&fit=crop&auto=webp pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT via 1.1 varnish x-content-type-options nosniff fastly-io-info ifsz=47585 idim=960x540 ifmt=jpeg ofsz=4630 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638101261013 fastly-stats io=1 content-length 4630 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "UYu3uqvOWz8TMuGFmYIrdaFAno5NX2ixswQIp49+2QA" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Tue, 05 Oct 2021 21:20:40 GMT
GET H2	200	inlineMedia_core.js Show response static.myfinance.com/widget/	174 KB 59 KB	58ms 25ms	Script application/javascript	172.67.180.49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia_core.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.180.49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5823c81b356c92ef235272904d68f3cb62dde3f31a566b6f5c46d2a33a7fb808 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4040 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id 9YP3S8PA3B9PRZ3R x-amz-id-2 ia56b7yw3Q1O4DaQTN9LZ0VipST5x8FvdjzIsWcUYZaEVoxxz78rQcc6UgDn+vXeOJcNI5DMU7w= last-modified Mon, 20 Sep 2021 18:10:52 GMT server cloudflare etag W/"184e91d041e75b4e373b681f2f0a2c29" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BvjEaH7zvh4fUWepiVlVF5YTkwSRybrnL6%2BGFauNiW%2BNqP7145D7qSVhgjus0EBVYV4vWi%2F2hh717BQKTI54EgZq31leVBbtjaFxCisgCCgSph%2B1QTC2BFXx7QHT2JMPbO%2F%2Fnn8AJg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript vary Accept-Encoding cache-control max-age=14400 cf-ray 69a4bbe79fd5c2fe-FRA
GET H2	200	show-hide-1.0-51cea9ac43-rev.js Show response www.zdnet.com/a/fly/js/components/	2 KB 863 B	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/show-hide-1.0-51cea9ac43-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/show-hide-1.0-51cea9ac43-rev.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:49 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1633120135735397 vary Accept-Encoding, Accept content-length 671 x-xss-protection 1; mode=block last-modified Fri, 01 Oct 2021 21:00:12 GMT server ContentServer x-frame-options SAMEORIGIN etag "eb84259d2c20a84a21983490d695f83e" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 11 Oct 2021 15:00:27 GMT
OPTIONS H2	204	record a.myfidevs.io/ Frame	0 0	291ms 96ms	Preflight	34.199.156.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Protocol H2 Server 34.199.156.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-199-156-235.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,x-api-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods POST access-control-allow-headers * server Python/3.7 aiohttp/3.7.4.post0
OPTIONS H2	200	v1.5 www.myfinance.com/api/au/ Frame	0 0	424ms 399ms	Preflight text/html	172.67.180.49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvYmxhY2tiZXJyeS10aWVzLW1hbHdhcmUtY2FtcGFpZ24tdGFyZ2V0aW5nLXZpY3RpbXMtaW4taW5kaWEtdG8tY2hpbmVzZS1jeWJlcmVzcGlvbmFnZS1ncm91cC8= Protocol H2 Server 172.67.180.49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-type text/html; charset=utf-8 vary Origin access-control-allow-credentials true access-control-allow-origin https://www.zdnet.com access-control-allow-headers x-requested-with, content-type, accept, origin, authorization, x-csrftoken, x-api-key, Access-Control-Allow-Origin access-control-allow-methods DELETE, GET, OPTIONS, PATCH, POST, PUT access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Ffy7UJR7N%2FQy47TyuKmUqDyAVLNGTuJGIa%2BGkX2XHVybg9FzhmauhE%2Ffdf4KDpuBXSGK0TISYH0ewxnqbcBhQVUoSTeITLrkv2JIjjN38hywPx8q0HfhUj8JNCOBzJ43RUC8hg%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15552000 x-content-type-options nosniff server cloudflare cf-ray 69a4bbe81ccd4e1a-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	inlineMedia.css static.myfinance.com/widget/	3 KB 2 KB	26ms 14ms	Stylesheet text/css	172.67.180.49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.180.49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 2491 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id RM9EMK8GHMB7NW7G x-amz-id-2 rO4/tb/v63P6c/qJxa0JBYiRUj2pmFCIHFUoYyKlU+xVn/UKNLDsHpQEB0iQ2jT47cP+krHxRTQ= last-modified Mon, 12 Jul 2021 14:22:18 GMT server cloudflare etag W/"528a38ce39fc58a866c1226253bbb189" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oQaQfoxOxSjLHWrhR9CwCpLVb9qjRpsAF08%2Bj0uWg0ssjkk%2FsgZGc4iAgcOANCpNFS4HiVRrDzT3Dng6nDrYcdeNNiXtUYo1enm2QUaMH8Vv7%2BgWx9CmlaDYBmjLz5PuPDPCN9Kc2g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css vary Accept-Encoding cache-control max-age=14400 cf-ray 69a4bbe7ff416977-FRA
POST H2	204	record Show response a.myfidevs.io/	0 166 B	121ms 119ms	XHR text/plain	34.199.156.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.199.156.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-199-156-235.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 x-api-key yuH27H1QId6afXAojow6Tafi7Vw9v1spaLD5Yznw Content-Type application/json Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT access-control-allow-credentials true server Python/3.7 aiohttp/3.7.4.post0 access-control-allow-headers * access-control-allow-methods POST
POST H3	200	v1.5 Show response www.myfinance.com/api/au/	1 KB 1 KB	245ms 233ms	XHR application/json	172.67.180.49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvYmxhY2tiZXJyeS10aWVzLW1hbHdhcmUtY2FtcGFpZ24tdGFyZ2V0aW5nLXZpY3RpbXMtaW4taW5kaWEtdG8tY2hpbmVzZS1jeWJlcmVzcGlvbmFnZS1ncm91cC8= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.180.49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dfa41d5f58913625ce994d3866ae080e41777010d90cc3eb54789a3e2a158e0 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-type application/json alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 allow POST, GET server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OfBi4LACyvTGSBLH8mxwb44JRKUpdHDfc%2FYwaYB7BIPRMK0L5v4RP88mNiWOJksBaQM%2FynJPtIktKhhFsjqSEvGNf67KR51OgTC7bftx8CwYvztSskOQ9%2BA%2BpkHyUWbuh03lhw%3D%3D"}],"group":"cf-nel","max_age":604800} content-language en-us access-control-allow-origin https://www.zdnet.com vary Accept, Accept-Language, Origin, Cookie cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 69a4bbeabc6042cf-FRA expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	159ms 158ms	XHR application/json	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=blackberry Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 590a2affed8eba74911d8945caebaf56362dc4bf263e524af5687f6ac1968a81 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br tracestate 78034@nr=0-1-2767451-695782612-2feff06b799b4537----1633584590128 accept-language de-DE,de;q=0.9 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMmZlZmYwNmI3OTliNDUzNyIsInRyIjoiMDNmZGUzMmE3MjM5OTViN2MyMTJlMjRhYjk3NzRlNTAiLCJ0aSI6MTYzMzU4NDU5MDEyOCwidGsiOiI3ODAzNCJ9fQ== sec-fetch-dest empty x-requested-with XMLHttpRequest cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; OptanonConsent=isIABGlobal=false&datestamp=Thu+Oct+07+2021+05%3A29%3A49+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=5e4da38f-3ad7-49bd-94cd-00159ed2010d&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; RT="z=1&dm=zdnet.com&si=79238c86-c228-47ea-85be-e6d73dfe39df&ss=kugi33n6&sl=0&tt=0&bcn=%2F%2F1737ad5b.akstat.io%2F"; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=6a1e207b-b617-4a6e-9cc6-8bf342f92a3d; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d; tglr_ref=; tglr_anon_id=af028148-8241-4dca-a695-e6ccfc4f995d; viewGuid=c59bf21f-efc6-4bb5-a8a7-d65e9b734529; cohsn_xs_id=c07c601e-d76e-4a95-b634-14e82645ab88; _mfuuid_=46f3eb11-6481-4878-96f2-8d6bec7c5080; fly_session=56ed6e2bfae4c3abc373bc54fa107421 :path /newsletter/xhr/widget-login/?topic=blackberry pragma no-cache x-newrelic-id VgEBVlJWCRAGXVRVDwMDUlc= traceparent 00-03fde32a723995b7c212e24ab9774e50-2feff06b799b4537-01 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept application/json, text/javascript, */*; q=0.01 cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d :scheme https sec-fetch-site same-origin :method GET X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-2feff06b799b4537----1633584590128 traceparent 00-03fde32a723995b7c212e24ab9774e50-2feff06b799b4537-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMmZlZmYwNmI3OTliNDUzNyIsInRyIjoiMDNmZGUzMmE3MjM5OTViN2MyMTJlMjRhYjk3NzRlNTAiLCJ0aSI6MTYzMzU4NDU5MDEyOCwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IAAZQU04aABtEVlJVA1IFAVJRVwwGCFsAVxFJXwBdElY/ x-frame-options SAMEORIGIN date Thu, 07 Oct 2021 05:29:50 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 170af6a8-f904-4325-8f6b-79842ca6fa53 content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private accept-ranges bytes expires Thu, 07 Oct 2021 05:29:50 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	40ms 39ms	Fetch image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuUQLsO3iKm5pJx-1CSkjVPhi_KOHR5z6cWmCqa9lEo_tt1xX2X8dxHXprq16CJT7i4D162Tod47IVlPK0jWgJQLlsir1scaJt-87J9CXnVTv-KJX7gQZy8twF5OWX821r9ia3ugAJwEcciTWXvKljZ97ftofRZfJKdKF7M1znWBgQYcXeAKSHg-BtWXLMUrBravzJNwI0JMmZYUios5Kyq3wlMeIgvXXQBGp8WmmTeJYPu5lzJj7qxMmLzYJNcgz05bMQXubsjg-Z6zSJXmXtFNKQmbMyn2a07DqjyK9ZFtjddr-5hxztjQNP7-KO6QXRNbAyXzA&sai=AMfl-YTzu4_yvjnV90jx4oHzlyAqbrkYAAU3AOkgQVHRya6-c25LRNYmZ93NDJ-txehTTmW4EoknE2pkcpuubu2aD2gIINdt31nIBRPyaQbEbwROh1b7J_fexdSltzAYuPpN&sig=Cg0ArKJSzP2c3gF0z5eoEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	ad.js Show response clipcentric-a.akamaihd.net/ad/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/	160 KB 43 KB	58ms 7ms	Script text/javascript	2.16.107.33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://clipcentric-a.akamaihd.net/ad/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/ad.js?q=1632517703 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-33.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 98b85112790d2d3f793d8dd19007470e551081ad864a7a1169abf51419da97d4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding br last-modified Thu Jan 1 00:00:00 1970 server Apache/2.2.34 cache-control max-age=3600 content-length 44033 content-type text/javascript
GET		rx_lidar.js www.googletagservices.com/activeview/js/current/	0 0
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/	334 KB 112 KB	7ms 7ms	Script application/x-javascript	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash bfca1731080c45e6c25fba9450707b3588abe7d36b7e5ab919a3efe2801de825 Request headers Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Oct 2021 05:29:50 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 21:48:12 GMT server AmazonS3 x-amz-request-id SC8W7A3WSXQ0SNN9 etag "fa23a41f0fd339f7192a4e24c76c9ec1" vary Accept-Encoding content-type application/x-javascript cache-control max-age=56047 accept-ranges bytes content-length 113980 x-amz-id-2 n/P4mf5P42vG2Xz2OmtkdHqVKUrn+mSo3Nal6RhjqRYlEnw6ah7YndTi1le+tpJOEiCPYwZnjMA=
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	40ms 40ms	Fetch image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuSUo6yEVTdw2USHn6nY0kSx5cCf3rAhzDe9eEPhMvA4rpqvwsqSYk-jiWfWMyC7pqjNA0I8gIKP1SlAu8Rrkg-gogNU-YpOvzIqDC33a-n131CmG3_4ywhJxTlNi6tux2S-MVPvgSIdXZ7DyVoMeje1mG9NgyBUEMoc5PuJH7Q9jl9RDaAHqVrnznJFYNtbpD5qEiVOKnk6XozE0P29KC6IkhNt3xEFPW0FOKuKCEE1gIluZo7najDnEgNTv9kLADs-X8h_mfACoaytZN12kQEawuUt9EJ0kxODx89VosWOWh1ZV8_3E1Qig02RUNp2g9AACcRwA&sai=AMfl-YSxrXe0ztzbt7SuY572ZJC0KlikiirKG43eyxYP8n5tupCw5ZvvTvEOQEaLkYJiVJbjG-A560bE-tVhmkZegLVC0a-xpRwV_rsCJljznqxXoDVLSAr8qmfJWDj9Rarv&sig=Cg0ArKJSzAQG3kVw1XsUEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	18195973009634318544 tpc.googlesyndication.com/simgad/	75 KB 75 KB	66ms 18ms	Image image/jpeg	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/18195973009634318544? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash e8df046a043dcac0b1fe9e01f14cab510e7df3a97a627fe1cf1e0fbc4166255a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 03 Oct 2021 15:35:31 GMT x-content-type-options nosniff age 309259 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 76670 x-xss-protection 0 last-modified Wed, 15 Sep 2021 01:57:23 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Mon, 03 Oct 2022 15:35:31 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	41ms 40ms	Fetch image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsufYsdX-_CcM2fFjqELeSsWgsuIQs9O00OlzqfOhhYSz-JSMy_keFgmT3IfEN-hpzFXMIg_Rdj8i9LC0_hCqpdLHRd8tzCT0ABWZxTFCEm7PbT3Sob_Mhs6_TQkGgu_w7sX9rh4uZ7eVczKMcYgMdxq8NFJx2vxYAiXgr1Z7jnLCwGW9Kf0zbxRqp6HSSEZevyci0AQk2TFKRjKlu6UqO-GDbY9e2s1xuQfUFUQFR2GKhUKx-1XlFZJ2ny7VomSMMhaWmNl7fNgQFKmt8wrLpk4sHKmv3YUSA0ANyLsKW0rgD7YCQK9P-mOfcUl_Oolvp5N_w&sai=AMfl-YQCgaVoBFJKS98Px3RvvDdQt0sgPIl1lTyeiFVvuKbkMXcKhJbUOibLheB2JhYnWbfmiugaqAFhFAHfoX1OIUjDoLfsiUs3tcd2IaWbnLrXQT3c7j44ge0k2rjL3arW&sig=Cg0ArKJSzDd4ZLQ1DnzFEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET		dcmads.js www.googletagservices.com/dcm/	0 0
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012109102127000/	189 KB 55 KB	41ms 6ms	Script text/javascript	142.250.186.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012109102127000/amp4ads-v0.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f1.1e100.net Software sffe / Resource Hash ba870dd4f1f375d33aa3770685227bd38160d194969b3840232fad67c1989bb8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 588368 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55506 x-xss-protection 0 server sffe date Thu, 30 Sep 2021 10:03:42 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c42e3b94efe0099e" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Fri, 30 Sep 2022 10:03:42 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012109102127000/v0/	13 KB 5 KB	52ms 18ms	Script text/javascript	142.250.186.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012109102127000/v0/amp-ad-exit-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f1.1e100.net Software sffe / Resource Hash 19ad029fe2230dc2b7eda8d3c2b8d872aae2e718c0209bcaec04cd51a04d9165 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 213577 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4995 x-xss-protection 0 server sffe date Mon, 04 Oct 2021 18:10:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "bc03df60ee69192f" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Tue, 04 Oct 2022 18:10:13 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012109102127000/v0/	89 KB 28 KB	54ms 20ms	Script text/javascript	142.250.186.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012109102127000/v0/amp-analytics-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f1.1e100.net Software sffe / Resource Hash d4cb8e3d3f1d9da69c5096249099aaa6ec5942dc20f922cc6c99f7b7b4557584 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 321621 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28507 x-xss-protection 0 server sffe date Sun, 03 Oct 2021 12:09:29 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "283b6526337df106" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Mon, 03 Oct 2022 12:09:29 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012109102127000/v0/	4 KB 2 KB	51ms 17ms	Script text/javascript	142.250.186.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012109102127000/v0/amp-fit-text-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f1.1e100.net Software sffe / Resource Hash d50905d9c0e2c1f4a30e217e1eade952d04600860ccf4aec5240e6fd31eb9b29 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 92904 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1638 x-xss-protection 0 server sffe date Wed, 06 Oct 2021 03:41:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "b3f838efba7b15f2" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Thu, 06 Oct 2022 03:41:26 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012109102127000/v0/	40 KB 13 KB	52ms 19ms	Script text/javascript	142.250.186.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012109102127000/v0/amp-form-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f1.1e100.net Software sffe / Resource Hash 235dd149eac993d9f773d67eb3432fda6c4d81c98d29c4fb150707fae2b59908 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 402663 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12820 x-xss-protection 0 server sffe date Sat, 02 Oct 2021 13:38:47 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "2e8049efde94274d" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 02 Oct 2022 13:38:47 GMT
GET DATA	200 OK	truncated /	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e9ca38bc7ce8583e1552a2770ba531e0f9a089e8a42ca1e35f73566fd036770a Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	css fonts.googleapis.com/	4 KB 692 B	42ms 17ms	Stylesheet text/css	142.250.185.138 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.138 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f10.1e100.net Software ESF / Resource Hash 2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 07 Oct 2021 05:01:01 GMT server ESF date Thu, 07 Oct 2021 05:29:50 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	css fonts.googleapis.com/	4 KB 1 KB	41ms 16ms	Stylesheet text/css	142.250.185.138 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.138 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f10.1e100.net Software ESF / Resource Hash 2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 07 Oct 2021 04:38:31 GMT server ESF date Thu, 07 Oct 2021 05:29:50 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	9141776347355671500 tpc.googlesyndication.com/simgad/	52 KB 52 KB	56ms 54ms	Image image/png	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/9141776347355671500?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qn9M75TC5cmnFOZsGH3auLeUtthRg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash 4a1b526c542afa3aff4cbec8b6a16992f04012e6aec44e76cf26b9ea3bc63722 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 30 Sep 2021 07:46:44 GMT x-content-type-options nosniff age 596586 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 53213 x-xss-protection 0 last-modified Tue, 28 Jul 2020 17:32:00 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Fri, 30 Sep 2022 07:46:44 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/	2 KB 3 KB	55ms 53ms	Image image/png	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 06 Oct 2021 14:19:22 GMT x-content-type-options nosniff server cafe age 54628 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Thu, 07 Oct 2021 14:19:22 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/	295 B 778 B	19ms 17ms	Image image/png	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 06 Oct 2021 14:31:09 GMT x-content-type-options nosniff server cafe age 53921 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 07 Oct 2021 14:31:09 GMT
GET H2	204	l www.google.com/ads/measurement/	0 0	73ms 23ms	Image text/html	216.58.212.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRan-DnfVF3Vwqh6c_JPETKNFg4TsqzGcjk-1Sv2SSHr9P9eaHq7KGHr9I9-a7U5Yrckq62lHOxUIfw46bbwv-q73hbeA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H3	200	adview securepubads.g.doubleclick.net/pagead/	0 0	40ms 40ms	Image text/html	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CzaeHzYVeYZDhMveX9u8P9dOFaNbOtrhlq8Xci_MLsJAfEAEg97vHgwFgyQagAaL0iMIDyAEC4AIAqAMByAMIqgTPA0_Qp13tzfREWze_FpvOHDJS2E38VI6CfIspGVkSdD6QuJSBiewXmRBE7PPSbboR584aHI_-2WMoK66CmSGD7zUS81-aqiyT_bcW1mhqOZF2eKKmwYKk8bSHt2fySXBV8nBcKcZfF52NoRJhL8nbeq0d70HtOXyNCv-gUrxcYNRstgfBwZq8ZNS9TRikGyyND9PUJGO0t4o-qX6Wecyo8gYUMqi9RvcAPC2ql07hUHz1uD-ulSNpDrAXdTh3IEraH-D3mqmlRyUk0JuHieUcXlbhdUagXuK00XO2OwnVcZ4_D-zi-R7gyG19bC5kHm4Uwx8U00dEWsw3_RGulrI6RZCIzBuD5434xSyKJNegNASIDiRmoX2m08YTPclc5N7wGLZHm02RAFrpZEy_BDu8GfXJF-FbzpHGmauxXgPNYvAHwCgKzNNvEdF2zB2g2SSXxy90jpH0J0ODIXsG74mSG_1A5g0CXqdmqE6ro7Uh9KaugWGclO35mE6h6DuZTqgws47grq_F7kzyWuKZ0Ku6GeVPh1i6JnHi1wHS0vI4ajHEWOSdfDtoKov6zqBYFPd2dsjcP4iXSJ1D9ejx8nvLbWKiMCvmUNz5POavN69aEjfABMrkz62HA-AEAZIFBAgEGAGSBQQIBRgEoAYCgAfGi_c9qAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAfIHBBDovBjSCAcIiGEQARgdgAoDyAsB2BMN0BUBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=kY_TyVEacDY Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/14353610180484219868/	24 KB 24 KB	72ms 71ms	Image image/jpeg	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/14353610180484219868/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2AMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qlIb2rW85cCJ1wuEdE6NZF3MU6OYA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash 41c622972a558b337feeff318a02f5166705a5a40ac2c3909942ed387526a02b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24532 x-xss-protection 0 last-modified Thu, 18 Apr 2019 15:20:00 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Fri, 07 Oct 2022 05:29:50 GMT
GET H2	200	40933678460698624 tpc.googlesyndication.com/simgad/	1 KB 1 KB	18ms 17ms	Image image/svg+xml	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/40933678460698624 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash 09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 02 Oct 2021 13:31:15 GMT content-encoding gzip x-content-type-options nosniff age 403115 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 728 x-xss-protection 0 last-modified Thu, 26 Oct 2017 18:18:20 GMT server sffe vary Accept-Encoding report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Sun, 02 Oct 2022 13:31:15 GMT
GET H3	200	adview securepubads.g.doubleclick.net/pagead/	0 0	41ms 41ms	Image text/html	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C5JXizYVeYZHhMveX9u8P9dOFaMWou6BZ6pSqgqUOyPDN7qsJEAEg97vHgwFgyQagAb6YuP8DyAEG4AIAqAMByAMKqgTYA0_QIWuLzs2gOCAcPf8fi4lXx2ltU-cvs9hv4jcAYWfIEL2fo3ocLth-6aL9FluNByALgyDfms7i1GEvF1C3UAaSBg7BgkIJchrr5CF5Q2Kol542iqsYq5jZr9_aL6AU2nye4MyY9QCbj3_k_uSrF9Kq2cPj1qkwPsbfXaceiniPG1vZmhAWxB8DgSlkdDP48y2mWMbUndn0mJolbfR4HFn6iSRssOtmM8KbwdEYLS2b75p5Ia98YqdFCg2lKtuEalMe8_Kztw7E-nVEte02PVv6ljm-gJi4ziei5Y42jerV_dPl4EHtKuOnc_mVMEAqkhGD_Twyx9GpH4bP-E5WicdLFoo0mByQX73M_5eL6gHcpeAw0_CmIfcZdcHCms0Wts6wz7UGiY4djvertfydgz2ZbvxELIKYqkckpLtbKKJ_vOEqPyj3GrQe6JMPI3zpnc4938ogVyFxkf_447KsFWmDdMeFpypFBXYb1dS4iV8DxIEbaU_RARtGsQNfVBA5b_TapSyhEj_OGytkd0VvvRBbFqdvDVE06zVNGkcF6FuNbGQV333Iw-uq0TMBXU9Yzb_dTdLwok4EystX9Q-AMXh5dkuFuaunGpp3lZxuRVVBQl-kSV58sdXABL7b8PbYAeAEAZIFBAgEGAGSBQQIBRgEoAY3gAeq50eoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcB8gcEEMzLPNIIBwiIYRABGB2ACgPICwHYEw3QFQGAFwGyFx4KHAgAEhRwdWItODgyMDM2MjYwNTcxMTE5NhjJm3o&sigh=ns9M7MUfywk&template_id=492 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 115d99cb47cd0b7a88a37234abbc2e3f19d44ef0369ff72f92d8dffd3ef40412 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	17ms 6ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=blackberry&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1633584589817&de=456073494171&rx=775156688276&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=3&cb=0&cu=1633584589817&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2865549754%3A5719795331%3A138352765952&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&id=1&ii=4&bo=aw-zdnet&bd=blackberry&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A631%3A631%3A669%3A577&jk=-1&jm=-1&fs=194656&na=798210898&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Thu, 07 Oct 2021 05:29:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 07 Oct 2021 05:29:50 GMT
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	68ms 31ms	XHR application/json	142.250.181.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021092301&st=env Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f2.1e100.net Software cafe / Resource Hash 298e0425f8afd3cfe10833af8dbf5a83cd88e95c850f98cfd5358c76dc98a136 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8489 x-xss-protection 0
GET H2	200	E=in,im,fi tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=33/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	303ms 99ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=33/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=in,im,fi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	AcYieNeq clipcentric-a.akamaihd.net/file/1269080/ad_q75/1632520987/	20 KB 20 KB	13ms 11ms	Image image/avif	2.16.107.33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1269080/ad_q75/1632520987/AcYieNeq?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-33.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 9fbcd9e76a4ba709ceef2d80184c5aebfd9bb1205885aacc3700fef860ddb0c9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT cache-control private, max-age=31536000 last-modified Fri, 24 Sep 2021 22:05:00 GMT server Apache/2.2.34 content-length 20754 content-type image/avif
GET H2	200	qIT9zTfG clipcentric-a.akamaihd.net/file/1269082/ad_q75/1632520987/	16 KB 16 KB	13ms 12ms	Image image/avif	2.16.107.33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1269082/ad_q75/1632520987/qIT9zTfG?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-33.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 478ac25e0d7ad55d0f58b29bcb614b6a5abea536e1ae0c45ac671e01053cf60b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT cache-control private, max-age=31536000 last-modified Fri, 24 Sep 2021 22:05:00 GMT server Apache/2.2.34 content-length 16413 content-type image/avif
GET H2	200	E=ls:Clipcentric%20Site%20Fixes.0,li tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=36/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 137 B	301ms 97ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=36/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:Clipcentric%20Site%20Fixes.0,li Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:Super%20Billboard.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=36/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	302ms 98ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=36/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:Super%20Billboard.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	OZiH54mt clipcentric-a.akamaihd.net/file/1269084/ad_q75/1632520987/	35 KB 35 KB	14ms 13ms	Image image/avif	2.16.107.33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1269084/ad_q75/1632520987/OZiH54mt?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-33.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 5a83683c675c2e4ce1612f6e7924a93a8832bccba6ecd208174232c4eb03dc78 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Oct 2021 05:29:50 GMT cache-control private, max-age=31536000 last-modified Fri, 24 Sep 2021 22:05:01 GMT server Apache/2.2.34 content-length 35616 content-type image/avif
GET H2	200	E=ls:hotspots%20expanded.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=38/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	395ms 191ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=38/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:hotspots%20expanded.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20partial%20expand.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=38/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	394ms 191ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=38/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:on%20scroll%20partial%20expand.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20full%20expand.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	301ms 98ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:on%20scroll%20full%20expand.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:custom%20ad%20controls.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	35 B 136 B	175ms 174ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=ls:custom%20ad%20controls.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 05:29:50 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v29/	15 KB 16 KB	31ms 7ms	Font font/woff2	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 04 Oct 2021 17:27:37 GMT x-content-type-options nosniff age 216133 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15688 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:19 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Tue, 04 Oct 2022 17:27:37 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v29/	16 KB 16 KB	34ms 12ms	Font font/woff2	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 16:31:43 GMT x-content-type-options nosniff age 46687 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15920 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:21 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 06 Oct 2022 16:31:43 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=blackberry&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1633584589817&de=185256257354&rx=775156688276&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=4&cb=0&cu=1633584589817&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2865549754%3A5719795331%3A138352765952&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fblackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group%2F%3Fftag%3Dtre21e7bbc%26bhid%3D%257b%2524external_id%257d%26mid%3D%257b%2524message_id%257d%26cid%3D%257b%2524contact_id%257d%26eh%3D%257b%2524cf_emailhash%257d&id=1&ii=4&bo=aw-zdnet&bd=blackberry&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A631%3A631%3A669%3A577&jk=-1&jm=-1&fs=194656&na=1941596157&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Thu, 07 Oct 2021 05:29:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 07 Oct 2021 05:29:50 GMT
GET		sodar2.js tpc.googlesyndication.com/sodar/	0 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	66ms 25ms	Image text/html	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/blackberry-ties-malware-campaign-targeting-victims-in-india-to-chinese-cyberespionage-group/?ftag=tre21e7bbc&bhid=%7b%24external_id%7d&mid=%7b%24message_id%7d&cid=%7b%24contact_id%7d&eh=%7b%24cf_emailhash%7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Redirect headers date Thu, 07 Oct 2021 05:29:50 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
POST H2	200	E=si,dt:0,ld:Super%20Billboard:97.0,le:Super%20Billboard:133:133.0,ld:hotspots%20expanded:96.0,le:hotspots%20expanded:134:134.0,ld:custom%20ad%20controls:95.0,le:custom%20ad%20controls:134:134.0 tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=140/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/	115 B 281 B	175ms 175ms	Ping application/octet-stream	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tr.clipcentric.com/s/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/Z=1/I=114.748747.1633584590482/U=www.zdnet.com/T=140/M=w/D=d/PO=zdnet.com/LO=5792314687/VO=138366997288/E=si,dt:0,ld:Super%20Billboard:97.0,le:Super%20Billboard:133:133.0,ld:hotspots%20expanded:96.0,le:hotspots%20expanded:134:134.0,ld:custom%20ad%20controls:95.0,le:custom%20ad%20controls:134:134.0 Requested by Host: clipcentric-a.akamaihd.net URL: https://clipcentric-a.akamaihd.net/ad/B=608/F=1269047/C=449720/P=22/L=21/V=23/S=zeGZgTi-/ad.js?q=1632517703 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 214dc5b3c7f529c707e203b8ea4bd194a269213ec95a4f13162fa564dce5d98f Request headers Referer https://www.zdnet.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 07 Oct 2021 05:29:50 GMT last-modified Tue, 12 Feb 2013 20:05:06 GMT server Apache/2.2.34 accept-ranges bytes etag "73-4d58c8ab38080" content-length 115 content-type text/plain; charset=UTF-8
GET H3	200	activeview pagead2.googlesyndication.com/pcs/	42 B 64 B	40ms 26ms	Image image/gif	142.250.181.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuYrs9Mq7ZtQq6M8Q0fyBvGTbajRpF6uTIMZBsYNdGbewVe4Ovb6jhaEJYtziG2NQk9zbzU3nAiVs10p7OdZSP-HS6l9QMUT1O666ERPk0xnE7o2ttW6f0tsnGQiWiNlWqy3dKZ3fOF9w&sai=AMfl-YQc-u24R1_FWXKsNCiFg29K9mPlHixFvVFidgnkbs2YIXIkMt3LtbYmgqAw2QYj7VW3pd57Pl-0WBzWZ0ZhxPB1EEuAYoViyVESVaVoiXAo3EY8Q99_6-2hfcn_EECb&sig=Cg0ArKJSzP8FW8Jvth9kEAE&id=ampim&o=0,316&d=1600,1200&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=94&tls=1094&g=100&h=100&tt=1095&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=3770109282 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.181.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Thu, 07 Oct 2021 05:29:51 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.googletagservices.com

URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Domain

www.googletagservices.com

URL

https://www.googletagservices.com/dcm/dcmads.js

Domain

tpc.googlesyndication.com

URL

https://tpc.googlesyndication.com/sodar/sodar2.js