urlscan.io logo urlscan.io
SecurityTrails logo

linux.m2osw.com Open in urlscan Pro
138.197.205.139  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://installation.m2osw.com/zmeu-attack
Effective URL: https://linux.m2osw.com/zmeu-attack
Submission: On June 24 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 22 IPs in 6 countries across 20 domains to perform 64 HTTP transactions. The main IP is 138.197.205.139, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is linux.m2osw.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 3rd 2016. Valid for: 3 years.
This is the only time linux.m2osw.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 24 138.197.205.139 14061 (DIGITALOC...)
2 209.197.3.15 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
1 1 176.32.100.230 16509 (AMAZON-02)
1 52.222.152.207 16509 (AMAZON-02)
1 52.94.229.212 16509 (AMAZON-02)
1 52.29.153.112 16509 (AMAZON-02)
6 151.139.128.10 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 6 35.190.59.101 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 35.190.40.172 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2 52.51.129.97 16509 (AMAZON-02)
3 3 54.171.6.140 16509 (AMAZON-02)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
2 2 147.75.102.200 54825 (PACKET)
2 2a03:2880:f12... 32934 (FACEBOOK)
2 35.201.67.47 15169 (GOOGLE)
64 22
24    138.197.205.139 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: m2osw.com
installation.m2osw.com
linux.m2osw.com
cdn.m2osw.com
2    209.197.3.15 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2606:4700::6813:c497 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
5    2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
1    176.32.100.230 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
ws-na.amazon-adsystem.com
1    52.222.152.207 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-152-207.fra53.r.cloudfront.net
images-na.ssl-images-amazon.com
1    52.94.229.212 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
ir-na.amazon-adsystem.com
1    52.29.153.112 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-29-153-112.eu-central-1.compute.amazonaws.com
bluehost-cdn.com
6    151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
s.skimresources.com
p.skimresources.com
1    2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
1    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
4    2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
googleads.g.doubleclick.net
www.googletagservices.com
2    2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ssl.google-analytics.com
6    35.190.59.101 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 101.59.190.35.bc.googleusercontent.com
r.skimresources.com
2    2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    35.190.40.172 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 172.40.190.35.bc.googleusercontent.com
api.skimlinks.mgr.consensu.org
1    2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
2    52.51.129.97 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-129-97.eu-west-1.compute.amazonaws.com
sync.crwdcntrl.net
3    54.171.6.140 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-171-6-140.eu-west-1.compute.amazonaws.com
x.skimresources.com
3    2a03:2880:f01c:216:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
1    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com
2    147.75.102.200 (Central, Hong Kong)

ASN54825 (PACKET - Packet Host, Inc., US)
loadeu.exelator.com
2    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
2    35.201.67.47 (Ascension Island)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 47.67.201.35.bc.googleusercontent.com
t.skimresources.com
Domain Requested by
22 linux.m2osw.com linux.m2osw.com
pagead2.googlesyndication.com
6 r.skimresources.com 2 redirects linux.m2osw.com
5 pagead2.googlesyndication.com linux.m2osw.com
pagead2.googlesyndication.com
4 p.skimresources.com linux.m2osw.com
3 connect.facebook.net cdn.m2osw.com
connect.facebook.net
3 x.skimresources.com 3 redirects
3 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 t.skimresources.com s.skimresources.com
2 www.facebook.com linux.m2osw.com
2 loadeu.exelator.com 2 redirects
2 sync.crwdcntrl.net 2 redirects
2 www.google.com 1 redirects ajax.googleapis.com
2 ssl.google-analytics.com 1 redirects linux.m2osw.com
2 s.skimresources.com linux.m2osw.com
s.skimresources.com
2 maxcdn.bootstrapcdn.com linux.m2osw.com
pagead2.googlesyndication.com
1 www.gstatic.com www.google.com
1 www.google.de linux.m2osw.com
1 stats.g.doubleclick.net 1 redirects
1 api.skimlinks.mgr.consensu.org s.skimresources.com
1 www.googletagservices.com pagead2.googlesyndication.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 bluehost-cdn.com linux.m2osw.com
1 ir-na.amazon-adsystem.com linux.m2osw.com
1 images-na.ssl-images-amazon.com linux.m2osw.com
1 ws-na.amazon-adsystem.com 1 redirects linux.m2osw.com
1 cdn.m2osw.com linux.m2osw.com
1 cdnjs.cloudflare.com linux.m2osw.com
1 ajax.googleapis.com linux.m2osw.com
1 installation.m2osw.com 1 redirects
64 30
Subject Issuer Validity Valid
*.m2osw.com
Go Daddy Secure Certificate Authority - G2		 2016-12-03 -
2020-02-05		 3 years crt.sh
*.bootstrapcdn.com
COMODO RSA Domain Validation Secure Server CA		 2018-10-03 -
2019-10-12		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-03-02 -
2019-09-08		 6 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
Images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2019-05-02 -
2020-04-23		 a year crt.sh
www.assoc-amazon.com
Amazon		 2019-03-09 -
2020-02-19		 a year crt.sh
*.bluehost-cdn.com
COMODO RSA Domain Validation Secure Server CA		 2018-05-22 -
2020-08-23		 2 years crt.sh
*.skimresources.com
DigiCert SHA2 Secure Server CA		 2018-09-13 -
2020-10-07		 2 years crt.sh
*.google.com
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
www.google.com
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
api.skimlinks.mgr.consensu.org
DigiCert SHA2 Secure Server CA		 2018-08-15 -
2019-10-23		 a year crt.sh
www.google.de
Google Internet Authority G3		 2019-06-11 -
2019-09-03		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-06-06 -
2019-09-04		 3 months crt.sh

This page contains 6 frames:

Primary Page: https://linux.m2osw.com/zmeu-attack
Frame ID: 8573533D582084813AB10F630447A173
Requests: 58 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Frame ID: 5122CBC1EFAFEFA3996766A2A3503460
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190619/r20190131/zrt_lookup.html
Frame ID: 9DD5EF5A00D48FE71990AE47AAA8F3CE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6922769707844748&output=html&adk=1812271804&adf=3025194257&lmt=1561394509&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1561394510980&bpp=149&bdt=1641&fdt=1008&idt=1008&shv=r20190619&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=1246865353420&frm=20&pv=2&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=0&iag=0&icsg=177021372017292&dssz=32&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&jar=2019-6-24-16&osw_key=3519083555&ifi=0&uci=0.7g02mbepwu3v&fsb=1&dtd=1057
Frame ID: 3C10088CC8593AC7336BE7F07282BDBD
Requests: 1 HTTP requests in this frame

Frame: https://p.skimresources.com/?provider_id=fd494f7267a043abe80ca9148738f577&skim_mapping=true
Frame ID: AA783FE32D00C4AB74AD6C6CE0D286C7
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6922769707844748&output=html&h=90&slotname=4390510086&adk=2598760692&adf=3818678473&w=200&lmt=1561394509&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&flash=0&wgl=1&adsid=NT&dt=1561394511211&bpp=54&bdt=1872&fdt=1974&idt=1974&shv=r20190619&cbv=r20190131&saldr=sa&abxe=1&prev_fmts=0x0&nras=1&correlator=1246865353420&frm=20&pv=1&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=1&iag=0&icsg=2832341952274572&dssz=38&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=595&ady=426&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=31&jar=2019-6-24-16&osw_key=1143517805&ifi=1&uci=1.atvxfeehx7ka&fsb=1&xpc=Uufifinpa7&p=https%3A//linux.m2osw.com&dtd=2000
Frame ID: DF08BD5587CAA92DE9DB865F839A9CF2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://installation.m2osw.com/zmeu-attack HTTP 301
    https://linux.m2osw.com/zmeu-attack Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • script /drupal\.js/i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • script /drupal\.js/i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /lightbox.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /\/recaptcha\/api\.js/i

Page Statistics

64
Requests

98 %
HTTPS

50 %
IPv6

20
Domains

30
Subdomains

22
IPs

6
Countries

711 kB
Transfer

1807 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://installation.m2osw.com/zmeu-attack HTTP 301
    https://linux.m2osw.com/zmeu-attack Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • https://ws-na.amazon-adsystem.com/widgets/q?_encoding=UTF8&ASIN=0134173260&Format=_SL250_&ID=AsinImage&MarketPlace=US&ServiceVersion=20070822&WS=1&tag=the-scam-page-20 HTTP 302
  • https://images-na.ssl-images-amazon.com/images/I/514TgqzQVuL._SL250_.jpg
Request Chain 40
  • https://r.skimresources.com/api/ HTTP 307
  • https://r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
Request Chain 48
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1045091394&utmhn=linux.m2osw.com&utme=8(User%20roles)9(anonymous%20user)11(1)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Attacks%20by%20ZmEu%20or%20w00tw00t%20robots%20%7C%20The%20Linux%20Page&utmhid=1120388109&utmr=-&utmp=%2Fzmeu-attack&utmht=1561394512688&utmac=UA-4615342-2&utmcc=__utma%3D140939823.1895209475.1561394512.1561394512.1561394512.1%3B%2B__utmz%3D140939823.1561394513.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=279640652&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAQAAAAE~ HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394&slf_rd=1&random=1107714012
Request Chain 50
  • https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
  • https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=fd494f7267a043abe80ca9148738f577 HTTP 302
  • https://p.skimresources.com/?provider_id=fd494f7267a043abe80ca9148738f577&skim_mapping=true
Request Chain 54
  • https://r.skimresources.com/api/ HTTP 307
  • https://r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
Request Chain 57
  • https://x.skimresources.com/?provider=exelate HTTP 302
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0& HTTP 302
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1 HTTP 302
  • https://x.skimresources.com/?provider=exelate2&skim_mapping=true&provider_id=911727a59ab6d8e5764be5703e05ae0b HTTP 302
  • https://p.skimresources.com/?provider_id=911727a59ab6d8e5764be5703e05ae0b&skim_mapping=true

64 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set zmeu-attack
linux.m2osw.com/
Redirect Chain
  • http://installation.m2osw.com/zmeu-attack
  • https://linux.m2osw.com/zmeu-attack
105 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
e35323a96e8a0572bb07cccf3036865a7e52fac491d3a7e24d2e77198fb1adc6

Request headers

Host
linux.m2osw.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
Vary
Pragma,Accept-Encoding
Set-Cookie
SESSfe1128b79ed5f1b9eb324fd49f535031=mdrksrp3hb26fsgt1g943t0uh7; expires=Wed, 17-Jul-2019 20:15:09 GMT; Max-Age=2000000; path=/; domain=.linux.m2osw.com
Expires
Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Cache-Control
must-revalidate
Connection
close
Content-Encoding
gzip
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8

Redirect headers

Date
Mon, 24 Jun 2019 16:41:48 GMT
Server
Apache
Location
https://linux.m2osw.com/zmeu-attack
Content-Length
243
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
css_4d30ec77b2c6c5280c5008becae7eff2.css
linux.m2osw.com/sites/linux.m2osw.com/files/css/ 		31 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
19c20a62f086f9418f9e27da6244cc43bd5dcc5cddc7a83b0f4040390a45ead0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:49 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"1c9e-58c147d141cb5"
Content-Type
text/css
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7326
Expires
Mon, 08 Jul 2019 16:41:49 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:49 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:20 GMT
access-control-allow-origin
*
etag
"1544639720"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
7050
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 01 Jun 2019 12:25:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2002609
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
30306
x-xss-protection
0
last-modified
Fri, 24 Mar 2017 20:55:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 31 May 2020 12:25:00 GMT
superfish.js
cdnjs.cloudflare.com/ajax/libs/superfish/1.7.9/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/superfish/1.7.9/js/superfish.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
77af65266af9d72cd5f79c4477368187c64f0a25966084159a2bd8e4629eb8b5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:49 GMT
content-encoding
br
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15780000; includeSubDomains
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:26:51 GMT
server
cloudflare
etag
W/"5afd4adb-1d86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Sat, 13 Jun 2020 16:41:49 GMT
cache-control
public, max-age=30672000
cf-ray
4ec026c38beac303-FRA
served-in-seconds
0.001
drupal.js
linux.m2osw.com/misc/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/misc/drupal.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
65a9a5d1f785ff2e9b6ab3570dd8e6c3c0ad0b4779f7463d9da7f6562a76e053

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:49 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"ecc-58c147d142c55"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3788
Expires
Mon, 08 Jul 2019 16:41:49 GMT
collapse.js
linux.m2osw.com/misc/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/misc/collapse.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
00e53ee2aed52b47c90b70f0c0dfd3c7970b09fb396e53011cc9b3bcb1dee3a7

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:49 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"3fc-58c147d142c55"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1020
Expires
Mon, 08 Jul 2019 16:41:49 GMT
adsense_click.js
linux.m2osw.com/sites/all/modules/adsense/contrib/adsense_click/ 		825 B
790 B 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/adsense/contrib/adsense_click/adsense_click.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
9dc2831e02d45903e5393a3b2317fbf7ef133211cccd7e655179498bd759ac44

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:49 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"1a1-58c147d143bf5"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
417
Expires
Mon, 08 Jul 2019 16:41:49 GMT
cutemenu.js
linux.m2osw.com/sites/all/modules/cutemenu/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/cutemenu/cutemenu.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
b619d8da2003f5dcb319470461297449a5bf21b17e6b0bb7a489ed329cc8f5e8

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"325-58c147d143bf5"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
805
Expires
Mon, 08 Jul 2019 16:41:50 GMT
googleanalytics.js
linux.m2osw.com/sites/all/modules/google_analytics/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/google_analytics/googleanalytics.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
61204a1dcd6d24265b99f72f1f24972c1842474a2479260303a234bafd5001f1

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"3be-58c147d143bf5"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
958
Expires
Mon, 08 Jul 2019 16:41:50 GMT
jquery.cookie.min.js
linux.m2osw.com/sites/all/modules/jquery_plugin/ 		956 B
932 B 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/jquery_plugin/jquery.cookie.min.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
e24fa457bb25eb15304312497b96b60573b7dd9effa25c7cb8cea5e1dd43fa4d

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"230-58c147d143bf5"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
560
Expires
Mon, 08 Jul 2019 16:41:50 GMT
back_from_comment.js
linux.m2osw.com/sites/all/modules/InsertNode/ 		781 B
826 B 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/InsertNode/back_from_comment.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
d2cef591a5a1e42c51317384067223d1014a1db845622b0cb6e5bd23844691f0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
W/"1c6-58c147d143bf5"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
454
Expires
Mon, 08 Jul 2019 16:41:50 GMT
recaptcha.js
linux.m2osw.com/sites/all/modules/recaptcha/ 		1 KB
978 B 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/recaptcha/recaptcha.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
18f126e53d17c5e4384102978d466905fee6ff0550ccd8d6697c9beb0b87f472

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"260-58c147d144b95"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
608
Expires
Mon, 08 Jul 2019 16:41:50 GMT
lightbox.js
linux.m2osw.com/sites/all/modules/lightbox2/js/ 		44 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/lightbox2/js/lightbox.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
554a166160fb76785e3395d10012844b8fdceb85d92f11ae9b47bd70f6e8e33d

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"284a-58c147d145b36"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
10314
Expires
Mon, 08 Jul 2019 16:41:50 GMT
base.js
linux.m2osw.com/sites/all/modules/views/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/views/js/base.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
99fd9b57c3cff3d8b16e33e62cc04ec27ac104e2add212a7806829d1f48096e3

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"56d-58c147d147a76"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
1389
Expires
Mon, 08 Jul 2019 16:41:50 GMT
ajax_view.js
linux.m2osw.com/sites/all/modules/views/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/views/js/ajax_view.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
aa5616a53ab39b3690842b5145c5ad9714df2d58123bb9b6388c2ef95b9ea603

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"90e-58c147d147a76"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
2318
Expires
Mon, 08 Jul 2019 16:41:50 GMT
boost.js
linux.m2osw.com/sites/all/modules/boost/ 		231 B
539 B 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/boost/boost.js?5
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
3c3f6c9880ef9b8affd344b7daae1f46acff13a212194458464909649ac4b0dd

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"aa-58c147d147a76"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
170
Expires
Mon, 08 Jul 2019 16:41:50 GMT
facebook-pixel.js
cdn.m2osw.com/js/ 		430 B
652 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.m2osw.com/js/facebook-pixel.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
57cd04759c3123b5c2ec9f72d0f932377bc4d333fe5112c4b31725cd33073afc

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 15 Dec 2017 18:08:49 GMT
Server
Apache
ETag
"1ae-56064e46f36f0-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
318
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		92 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
661637cb0ba0317f215aacfdb8b3deb04b71087f892feb3016130f5a1b84c4d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
34609
x-xss-protection
0
server
cafe
etag
910771901220486472
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 24 Jun 2019 16:41:49 GMT
boot_sector-small.jpg
linux.m2osw.com/sites/linux.m2osw.com/files/images/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/linux.m2osw.com/files/images/boot_sector-small.jpg
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
0c0a009840e8a433ce9b983b0c23fb653b4eae42edbdd6d95376cc0cdfe6c171

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:50 GMT
Last-Modified
Mon, 13 Jul 2009 07:30:32 GMT
Server
Apache
ETag
"4789-46e914c0bd600"
Content-Type
image/jpeg
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
18313
Expires
Mon, 08 Jul 2019 16:41:50 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ 		65 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
07f07e6e07c15081c9ceca4c659f85ddbf65bfc72a389933a86dea411c4d6c75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25355
x-xss-protection
0
server
cafe
etag
1751326445140376599
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 24 Jun 2019 16:41:49 GMT
zmeu.jpg
linux.m2osw.com/sites/linux.m2osw.com/files/images/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/linux.m2osw.com/files/images/zmeu.jpg
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
db52646425ec36fbb1213fff1967443a7adeb0a84dace31cc51f32ec0b85133f

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Thu, 22 Jul 2010 07:37:10 GMT
Server
Apache
ETag
"6621-48bf4fc6b1580"
Content-Type
image/jpeg
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
26145
Expires
Mon, 08 Jul 2019 16:41:51 GMT
514TgqzQVuL._SL250_.jpg
images-na.ssl-images-amazon.com/images/I/
Redirect Chain
  • https://ws-na.amazon-adsystem.com/widgets/q?_encoding=UTF8&ASIN=0134173260&Format=_SL250_&ID=AsinImage&MarketPlace=US&ServiceVersion=20070822&WS=1&tag=the-scam-page-20
  • https://images-na.ssl-images-amazon.com/images/I/514TgqzQVuL._SL250_.jpg
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/images/I/514TgqzQVuL._SL250_.jpg
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.152.207 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-152-207.fra53.r.cloudfront.net
Software
Server /
Resource Hash
945cb21a3fa578c78d0609ac3bf8a0cda2f737740ddb9fe619207024f090540b

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 15 Jun 2019 22:08:42 GMT
via
1.1 91db3e27f70759a0dea967c4b34efea9.cloudfront.net (CloudFront)
age
1246378
x-cache
Hit from cloudfront
status
200
content-length
14255
last-modified
Wed, 23 Aug 2017 15:48:39 GMT
server
Server
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
a9a519fe-bab9-4ae6-b03e-acc7e7b38186
x-amz-cf-pop
FRA53
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
5VsMxbs4VK7G93J22d6qIkbVNombOEqr2W_ce4JeOp2UcQeKCquwkw==
expires
Sun, 05 Jun 2039 06:28:54 GMT

Redirect headers

Location
https://images-na.ssl-images-amazon.com/images/I/514TgqzQVuL._SL250_.jpg
Date
Mon, 24 Jun 2019 16:41:51 GMT
Server
Server
Content-Length
0
Vary
User-Agent
nnCoection
close
ir
ir-na.amazon-adsystem.com/e/ 		42 B
159 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ir-na.amazon-adsystem.com/e/ir?t=the-scam-page-20&l=li3&o=1&a=0134173260
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.94.229.212 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Cache-Control
no-cache
Connection
close
Content-Length
42
Content-Type
image/gif
160x600BW.png
bluehost-cdn.com/media/partner/images/alexiswilke/160x600/ 		13 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bluehost-cdn.com/media/partner/images/alexiswilke/160x600/160x600BW.png
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.29.153.112 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-29-153-112.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
7df3ee05491bfc38f7928e151b5db6fff36134f9a1e414db1758145cae3e2b50

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
x-o
770350714507a804eb35a9a5148a20bf
x-proxy-cache
EXPIRED
content-length
12270
expires
Mon, 01 Jul 2019 16:41:51 GMT
adsense_cse.js
linux.m2osw.com/sites/all/modules/adsense/cse/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://linux.m2osw.com/sites/all/modules/adsense/cse/adsense_cse.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
4122adc108e919d986cb016476deda6cb3c8bb61936821114030f517ca74bb9e

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Jun 2019 16:41:49 GMT
Server
Apache
ETag
"48a-58c147d147a76"
Content-Type
text/javascript
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
1162
Expires
Mon, 08 Jul 2019 16:41:51 GMT
115263X1574393.skimlinks.js
s.skimresources.com/js/ 		54 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.skimresources.com/js/115263X1574393.skimlinks.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b81215a8c84e8fd85821bae3b154c28f98a576e237432030d617069b3bc966d6

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
content-encoding
gzip
last-modified
Mon, 24 Jun 2019 09:51:59 GMT
server
AmazonS3
x-amz-request-id
55D1F43EAACFCB57
etag
"d0c5186cd48bb0c5b20d92e5bb362f32"
x-hw
1561394511.cds072.lo4.hn,1561394511.cds056.lo4.c
content-type
application/octet-stream
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
20612
x-amz-id-2
ymIydnEM6ooFT0QNBl9/Ck7N7OH0S1Hndv//nvYMcWqcOExuLhZqKzXwk39YRbPty6rXQ+ZOkI0=
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=linux.m2osw.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		121 B
188 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=linux.m2osw.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
2494b59e630043c90be146cc0f164209a32d41b1357d48f9038dada49ecb826a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
118
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/ 		211 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
647b3ad97fa34609e2edf234d06e56642e08b912404bd7b2250c47197b9a20bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
79902
x-xss-protection
0
server
cafe
etag
16229570540725976963
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 24 Jun 2019 16:41:51 GMT
top-left.png
linux.m2osw.com/sites/all/themes/white/images/ 		232 B
571 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/all/themes/white/images/top-left.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
768894b0ab8eef703611a1468246a83a91ba32d574002d63a88ae5c2baf5d52b

Request headers

Referer
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Sat, 20 Dec 2008 23:53:29 GMT
Server
Apache
ETag
"e8-45e8321e19040"
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
232
Expires
Mon, 08 Jul 2019 16:41:51 GMT
top-right.png
linux.m2osw.com/sites/all/themes/white/images/ 		255 B
595 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/all/themes/white/images/top-right.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
18a5e0dde4d792d27e6c74340155c907dadde7a7d2e81cb4fa422e14308f3dd1

Request headers

Referer
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Sat, 20 Dec 2008 23:54:17 GMT
Server
Apache
ETag
"ff-45e8324bdfc40"
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
255
Expires
Mon, 08 Jul 2019 16:41:51 GMT
background.png
linux.m2osw.com/sites/all/themes/white/images/ 		678 B
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/all/themes/white/images/background.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
a076a026af0a89e8a3cde2309adc5bfe15404085ffcbe540e7c744af10a80dd1

Request headers

Referer
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Sat, 20 Dec 2008 22:41:18 GMT
Server
Apache
ETag
"2a6-45e821fbbbf80"
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=91
Content-Length
678
Expires
Mon, 08 Jul 2019 16:41:51 GMT
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://linux.m2osw.com

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:36:18 GMT
access-control-allow-origin
*
etag
"1544639778"
vary
Accept-Encoding
x-cache
HIT
content-type
font/woff2
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
77171
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/ Frame 5122 		211 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
647b3ad97fa34609e2edf234d06e56642e08b912404bd7b2250c47197b9a20bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
79902
x-xss-protection
0
server
cafe
etag
16229570540725976963
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 24 Jun 2019 16:41:51 GMT
ca-pub-6922769707844748.js
pagead2.googlesyndication.com/pub-config/r20160913/ 		68 B
209 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-6922769707844748.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 10:53:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
20874
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
88
x-xss-protection
0
expires
Mon, 24 Jun 2019 22:53:57 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190619/r20190131/ Frame 9DD5 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20190619/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20190619/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://linux.m2osw.com/zmeu-attack
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://linux.m2osw.com/zmeu-attack

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Wed, 19 Jun 2019 23:05:34 GMT
expires
Wed, 03 Jul 2019 23:05:34 GMT
content-type
text/html; charset=UTF-8
etag
13378445451725915662
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
7040
x-xss-protection
0
cache-control
public, max-age=1209600
age
408977
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
q
ws-na.amazon-adsystem.com/widgets/ 		0
0
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 21 May 2019 23:53:44 GMT
server
Golfe2
age
1640
date
Mon, 24 Jun 2019 16:14:31 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17168
expires
Mon, 24 Jun 2019 18:14:31 GMT
bottom-left.png
linux.m2osw.com/sites/all/themes/white/images/ 		265 B
605 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/all/themes/white/images/bottom-left.png
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
564a65269d36f4b4c2039b9937ac79352e79af639462bac4988efb650806ad9f

Request headers

Referer
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Sun, 21 Dec 2008 00:53:05 GMT
Server
Apache
ETag
"109-45e83f706fe40"
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=90
Content-Length
265
Expires
Mon, 08 Jul 2019 16:41:51 GMT
bottom-right.png
linux.m2osw.com/sites/all/themes/white/images/ 		230 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linux.m2osw.com/sites/all/themes/white/images/bottom-right.png
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
138.197.205.139 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
m2osw.com
Software
Apache /
Resource Hash
9e6ebad6ab4f25ec32898f6dbfa6e69009d90a08bddead861a62cb8f5a038cf8

Request headers

Referer
https://linux.m2osw.com/sites/linux.m2osw.com/files/css/css_4d30ec77b2c6c5280c5008becae7eff2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Jun 2019 16:41:51 GMT
Last-Modified
Sun, 21 Dec 2008 00:54:06 GMT
Server
Apache
ETag
"e6-45e83faa9c780"
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
230
Expires
Mon, 08 Jul 2019 16:41:51 GMT
/
r.skimresources.com/api/
Redirect Chain
  • https://r.skimresources.com/api/
  • https://r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Origin
null
Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
via
1.1 google
server
openresty/1.11.2.5
access-control-allow-origin
https://linux.m2osw.com
location
//r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
307
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
193

Redirect headers

date
Mon, 24 Jun 2019 16:41:51 GMT
via
1.1 google
server
openresty/1.11.2.5
status
307
location
//r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
193
px.gif
p.skimresources.com/ 		43 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.skimresources.com/px.gif?ch=1&rn=6.113900558697044
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
status
200
x-guploader-uploadid
AEnB2UrgeVryDFBJUI400PCCT7VFsEOTa9z-JZl2zqDo1oma5ANejLozOS5wESrjbz6LLj61Wv2XHDZP65TgSOqK-lPRI6PBoQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1561394511.cds072.lo4.hn,1561394511.cds101.lo4.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
px.gif
p.skimresources.com/ 		43 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.skimresources.com/px.gif?ch=2&rn=6.113900558697044
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:51 GMT
status
200
x-guploader-uploadid
AEnB2UrgeVryDFBJUI400PCCT7VFsEOTa9z-JZl2zqDo1oma5ANejLozOS5wESrjbz6LLj61Wv2XHDZP65TgSOqK-lPRI6PBoQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1561394511.cds072.lo4.hn,1561394511.cds101.lo4.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
ads
googleads.g.doubleclick.net/pagead/ Frame 3C10 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6922769707844748&output=html&adk=1812271804&adf=3025194257&lmt=1561394509&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1561394510980&bpp=149&bdt=1641&fdt=1008&idt=1008&shv=r20190619&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=1246865353420&frm=20&pv=2&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=0&iag=0&icsg=177021372017292&dssz=32&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&jar=2019-6-24-16&osw_key=3519083555&ifi=0&uci=0.7g02mbepwu3v&fsb=1&dtd=1057
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6922769707844748&output=html&adk=1812271804&adf=3025194257&lmt=1561394509&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1561394510980&bpp=149&bdt=1641&fdt=1008&idt=1008&shv=r20190619&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=1246865353420&frm=20&pv=2&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=0&iag=0&icsg=177021372017292&dssz=32&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&jar=2019-6-24-16&osw_key=3519083555&ifi=0&uci=0.7g02mbepwu3v&fsb=1&dtd=1057
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://linux.m2osw.com/zmeu-attack
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUmWUL97bJoJz-vS6m7ECnXdfMkNIBPihhXbnTr0gTqG1zHJcLLHcEMtSFCn
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://linux.m2osw.com/zmeu-attack

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 24 Jun 2019 16:41:52 GMT
server
cafe
content-length
44
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
osd.js
www.googletagservices.com/activeview/js/current/ 		75 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7cec930c8706e25c7dddb1c12ebae9580ae10207817d7ff122600e6dae6ec10d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1561115551053641"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28356
x-xss-protection
0
expires
Mon, 24 Jun 2019 16:41:52 GMT
/
r.skimresources.com/api/ 		142 B
454 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r.skimresources.com/api/?xguid=01DE55TZSJ4ZJ40PFRYT71FCTV&persistence=1&checksum=9a71fe7f7d58cf27dbfe79feff8f01fb012f20729cebb64bc7a1822b01f53162
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
d18e24e486ab49d31e5edfa0227469a9d2c499c222a9eab0aa4de34caf355d5d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
Origin
https://linux.m2osw.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 24 Jun 2019 16:41:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
openresty/1.11.2.5
status
200
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
api.js
www.google.com/recaptcha/ 		845 B
590 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?onload=drupal_recaptcha_ready&render=explicit
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
95bc9a11600153e14e462613a569c02ea2b757fb8c720a7a1cbfcfe7cbdf45b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
470
x-xss-protection
1; mode=block
expires
Mon, 24 Jun 2019 16:41:52 GMT
iab
api.skimlinks.mgr.consensu.org/ 		772 B
637 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.skimlinks.mgr.consensu.org/iab
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/115263X1574393.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
172.40.190.35.bc.googleusercontent.com
Software
nginx/1.14.0 /
Resource Hash
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://linux.m2osw.com/zmeu-attack
Origin
https://linux.m2osw.com

Response headers

date
Mon, 24 Jun 2019 16:41:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.14.0
access-control-allow-headers
*
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1045091394&utmhn=linux.m2osw.com&utme=8(User%20roles)9(anonymous%20user)11(1)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394&slf_rd=1&random=1107714012
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394&slf_rd=1&random=1107714012
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 24 Jun 2019 16:41:53 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 24 Jun 2019 16:41:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-4615342-2&cid=1895209475.1561394512&jid=279640652&_v=5.7.2&z=1045091394&slf_rd=1&random=1107714012
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Consent_A_de.js
s.skimresources.com/js/GDPR/ 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.skimresources.com/js/GDPR/Consent_A_de.js
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/115263X1574393.skimlinks.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
57494356b669bc2e12eac5422c0506a8a9a5b59d608abc785d0bdddb00a07956

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:52 GMT
content-encoding
gzip
last-modified
Mon, 10 Jun 2019 09:14:27 GMT
server
AmazonS3
x-amz-request-id
A43F3B459A294D4A
etag
"0998579f01f1db19df613642a243be6d"
x-hw
1561394512.cds072.lo4.hn,1561394512.cds078.lo4.c
content-type
application/octet-stream
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
7697
x-amz-id-2
8X39ELG97yMMOFaxee8ZV8RzQOnIfpotcRgwtjYOpUF2P53AHEyhz6fPuFnITuw7HNYZ6/nQbm0=
/
p.skimresources.com/ Frame AA78
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
  • https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
  • https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=fd494f7267a043abe80ca9148738f577
  • https://p.skimresources.com/?provider_id=fd494f7267a043abe80ca9148738f577&skim_mapping=true
43 B
246 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.skimresources.com/?provider_id=fd494f7267a043abe80ca9148738f577&skim_mapping=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:54 GMT
status
200
x-guploader-uploadid
AEnB2UoK7bVsIqcna2EpbKn7Jf96G_vNgk7hSBegn9glvsz-bx42R2R_bsjoFQFaXmR-hiT17KxrzXRNYhdQ3_y8t6U_ogaLvA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1561394514.cds072.lo4.hn,1561394514.cds092.lo4.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif

Redirect headers

Location
https://p.skimresources.com?provider_id=fd494f7267a043abe80ca9148738f577&skim_mapping=true
Date
Mon, 24 Jun 2019 16:41:54 GMT
Server
TornadoServer/2.4.1
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
0
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
fbevents.js
connect.facebook.net/en_US/ 		53 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: cdn.m2osw.com
URL: https://cdn.m2osw.com/js/facebook-pixel.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding
content-length
16120
x-xss-protection
0
pragma
public
x-fb-debug
JFbSOqIt18CU2tPmSl8VbyeU1cWMuF69877QiAR7bg7at3sivwxOMR6i1ZzV9H+zrUw81tIsutMWj/PgFwW4Nw==
x-fb-trip-id
660048238
date
Mon, 24 Jun 2019 16:41:53 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/api2/v1560753160450/ 		264 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/api2/v1560753160450/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=drupal_recaptcha_ready&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0c74c4e497891e92d908560789d3293a4b83573fb761b7d6ade1b589ea2c1838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 19 Jun 2019 21:59:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 17 Jun 2019 23:15:00 GMT
server
sffe
age
412962
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
94077
x-xss-protection
0
expires
Thu, 18 Jun 2020 21:59:11 GMT
292188647896332
connect.facebook.net/signals/config/ 		228 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/292188647896332?v=2.8.51&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b682d14a1b3e6595666c965f7be7be781019878367a02b2955aa7d2e59013baf
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
61414
x-xss-protection
0
pragma
public
x-fb-debug
gQavK2ednjLoG06BWVw9XCv9ayA/x0Ahk6grx1jqq64TfqSpSku4Yq54kNkmnnNZ+3V8FftxagkBz7fjoJQlPg==
x-fb-trip-id
660048238
date
Mon, 24 Jun 2019 16:41:53 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
r.skimresources.com/api/
Redirect Chain
  • https://r.skimresources.com/api/
  • https://r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Origin
null
Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:53 GMT
via
1.1 google
server
openresty/1.11.2.5
access-control-allow-origin
https://linux.m2osw.com
location
//r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
307
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
193

Redirect headers

date
Mon, 24 Jun 2019 16:41:53 GMT
via
1.1 google
server
openresty/1.11.2.5
status
307
location
//r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
193
ads
googleads.g.doubleclick.net/pagead/ Frame DF08 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6922769707844748&output=html&h=90&slotname=4390510086&adk=2598760692&adf=3818678473&w=200&lmt=1561394509&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&flash=0&wgl=1&adsid=NT&dt=1561394511211&bpp=54&bdt=1872&fdt=1974&idt=1974&shv=r20190619&cbv=r20190131&saldr=sa&abxe=1&prev_fmts=0x0&nras=1&correlator=1246865353420&frm=20&pv=1&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=1&iag=0&icsg=2832341952274572&dssz=38&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=595&ady=426&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=31&jar=2019-6-24-16&osw_key=1143517805&ifi=1&uci=1.atvxfeehx7ka&fsb=1&xpc=Uufifinpa7&p=https%3A//linux.m2osw.com&dtd=2000
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190619/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6922769707844748&output=html&h=90&slotname=4390510086&adk=2598760692&adf=3818678473&w=200&lmt=1561394509&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&flash=0&wgl=1&adsid=NT&dt=1561394511211&bpp=54&bdt=1872&fdt=1974&idt=1974&shv=r20190619&cbv=r20190131&saldr=sa&abxe=1&prev_fmts=0x0&nras=1&correlator=1246865353420&frm=20&pv=1&ga_vid=1895209475.1561394512&ga_sid=1561394512&ga_hid=1120388109&ga_fc=1&iag=0&icsg=2832341952274572&dssz=38&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=595&ady=426&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=31&jar=2019-6-24-16&osw_key=1143517805&ifi=1&uci=1.atvxfeehx7ka&fsb=1&xpc=Uufifinpa7&p=https%3A//linux.m2osw.com&dtd=2000
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://linux.m2osw.com/zmeu-attack
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUkJCvl53YFWz4-SORZbljWA-f1rNeQ2E3hFzguHC9na-lLMnZdCdgfc-7xC
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://linux.m2osw.com/zmeu-attack

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 24 Jun 2019 16:41:53 GMT
server
cafe
content-length
152
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
/
r.skimresources.com/api/ 		130 B
390 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r.skimresources.com/api/?xguid=01DE55V19T6DHYZNH0TV183WM5&persistence=1&checksum=18d5422361372d7f56d74979a7b38aeb3e6ccd6804445910d11e2fd67be819d9
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
c60b15a07d774e3240d2cb5817462e56f09e5ac96aeb2e2ae20a8eb86c904deb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
Origin
https://linux.m2osw.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 24 Jun 2019 16:41:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
openresty/1.11.2.5
status
200
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
/
p.skimresources.com/ Frame AA78
Redirect Chain
  • https://x.skimresources.com/?provider=exelate
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1
  • https://x.skimresources.com/?provider=exelate2&skim_mapping=true&provider_id=911727a59ab6d8e5764be5703e05ae0b
  • https://p.skimresources.com/?provider_id=911727a59ab6d8e5764be5703e05ae0b&skim_mapping=true
43 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.skimresources.com/?provider_id=911727a59ab6d8e5764be5703e05ae0b&skim_mapping=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:54 GMT
status
200
x-guploader-uploadid
AEnB2UoK7bVsIqcna2EpbKn7Jf96G_vNgk7hSBegn9glvsz-bx42R2R_bsjoFQFaXmR-hiT17KxrzXRNYhdQ3_y8t6U_ogaLvA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1561394514.cds072.lo4.hn,1561394514.cds092.lo4.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif

Redirect headers

Location
https://p.skimresources.com?provider_id=911727a59ab6d8e5764be5703e05ae0b&skim_mapping=true
Date
Mon, 24 Jun 2019 16:41:54 GMT
Server
TornadoServer/2.4.1
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
0
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
inferredEvents.js
connect.facebook.net/signals/plugins/ 		1 KB
913 B 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.8.51
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
772
x-xss-protection
0
pragma
public
x-fb-debug
uzdACaoFHE4V2pZ27bpT07DLgsI/tR7H28zkHwOdwBnWgThrOOyjGfYbr83XoGnnFq1EnWs03UnIMZVehoOecA==
x-fb-trip-id
660048238
date
Mon, 24 Jun 2019 16:41:53 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
254 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=292188647896332&ev=PageView&dl=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&rl=&if=false&ts=1561394513350&sw=1600&sh=1200&v=2.8.51&r=stable&ec=0&o=30&fbp=fb.1.1561394513345.60927171&it=1561394513172&coo=false&rqm=GET
Requested by
Host: linux.m2osw.com
URL: https://linux.m2osw.com/zmeu-attack
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:53 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 24 Jun 2019 16:41:53 GMT
page
t.skimresources.com/api/v2/ 		22 B
384 B 		Other
General
Check archive.org
Download Go to
Full URL
https://t.skimresources.com/api/v2/page
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/115263X1574393.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
Origin
https://linux.m2osw.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 24 Jun 2019 16:41:53 GMT
via
1.1 google
x-content-type-options
nosniff
alt-svc
clear
server
Python/3.7 aiohttp/3.5.4
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
status
200
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
content-length
22
link
t.skimresources.com/api/v2/ 		22 B
91 B 		Other
General
Check archive.org
Download Go to
Full URL
https://t.skimresources.com/api/v2/link
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/115263X1574393.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
Origin
https://linux.m2osw.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 24 Jun 2019 16:41:53 GMT
via
1.1 google
x-content-type-options
nosniff
alt-svc
clear
server
Python/3.7 aiohttp/3.5.4
access-control-allow-origin
https://linux.m2osw.com
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
status
200
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
content-length
22
/
www.facebook.com/tr/ 		44 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=292188647896332&ev=Microdata&dl=https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack&rl=&if=false&ts=1561394513869&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Attacks%20by%20ZmEu%20or%20w00tw00t%20robots%20%7C%20The%20Linux%20Page%22%2C%22meta%3Akeywords%22%3A%22ZmEu%2Cattack%2Chacker%22%2C%22meta%3Adescription%22%3A%22Who%20is%20ZmEu%3F%20(An%20image%20showing%20Zmeu)%20The%20name%20Zmeu%20(no%20capital%20E)%20is%20the%20name%20of%20a%20fantastic%20creature%20of%20Romania.%20There%20are%20so%20many%20stories%20that%20there%20isn%27t%20a%20clear%20understanding%20of%20what%20it%20is...%20but%20it%20is%20human%20like%2C%20can%20spit%20fire%20and%20wants%20to%20marry%20young%20women.%20If%20you%27re%20wondering%2C%20it%20is%20generally%20a%20bad%20guy.%20ZmEu%20Attack%20Today%2C%20I%20noticed%20a%22%7D&cd[OpenGraph]=%7B%22og%3Asite_name%22%3A%22The%20Linux%20Page%22%2C%22og%3Atitle%22%3A%22Attacks%20by%20ZmEu%20or%20w00tw00t%20robots%22%2C%22og%3Adescription%22%3A%22Who%20is%20ZmEu%3F%20(An%20image%20showing%20Zmeu)%20The%20name%20Zmeu%20(no%20capital%20E)%20is%20the%20name%20of%20a%20fantastic%20creature%20of%20Romania.%20There%20are%20so%20many%20stories%20that%20there%20isn%27t%20a%20clear%20understanding%20of%20what%20it%20is...%20but%20it%20is%20human%20like%2C%20can%20spit%20fire%20and%20wants%20to%20marry%20young%20women.%20If%20you%27re%20wondering%2C%20it%20is%20generally%20a%20bad%20guy.%20ZmEu%20Attack%20Today%2C%20I%20noticed%20a%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Flinux.m2osw.com%2Fzmeu-attack%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.8.51&r=stable&ec=1&o=30&fbp=fb.1.1561394513868.1122724916&it=1561394513172&coo=false&es=automatic&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://linux.m2osw.com/zmeu-attack
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Jun 2019 16:41:53 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 24 Jun 2019 16:41:53 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ws-na.amazon-adsystem.com
URL
http://ws-na.amazon-adsystem.com/widgets/q?rt=tf_cw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822%2FUS%2Fthescapagofal-20%2F8010%2Fbd8b9d2f-f3d5-4e06-87e4-01b617a62675&Operation=GetScriptTemplate

Verdicts & Comments Add Verdict or Comment

196 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| Drupal string| lastStatus function| adsense_click undefined| iframeObj object| elements function| cutemenu function| cutemenu_mouseover function| cutemenu_mouseout function| cutemenu_subitem_mouseover function| cutemenu_subitem_mouseout object| output_element object| cutemenu_object function| insert_node_destination function| drupal_recaptcha_ready function| drupal_setup_captcha object| Lightbox object| adsbygoogle object| google_ad_client object| google_ad_slot object| google_ad_width object| google_ad_height object| google_js_reporting_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state object| google_sa_queue object| google_sl_win function| google_process_slots function| google_spfd object| google_sv_map object| google_t12n_vars boolean| google_onload_fired number| google_unique_id object| google_ad_block object| google_ad_channel object| google_ad_format object| google_ad_host object| google_ad_host_channel object| google_ad_host_tier_id object| google_ad_layout object| google_ad_layout_key object| google_ad_output object| google_ad_region object| google_ad_section object| google_ad_type object| google_ad_unit_key object| google_ad_dom_fingerprint object| google_ad_semantic_area object| google_adtest object| google_allow_expandable_ads object| google_alternate_ad_url object| google_alternate_color object| google_available_width object| google_captcha_token object| google_city object| google_color_bg object| google_color_border object| google_color_line object| google_color_link object| google_color_text object| google_color_url object| google_container_id object| google_content_recommendation_ad_positions object| google_content_recommendation_columns_num object| google_content_recommendation_rows_num object| google_content_recommendation_ui_type object| google_content_recommendation_use_square_imgs object| google_contents object| google_core_dbp object| google_country object| google_cpm object| google_ctr_threshold object| google_cust_age object| google_cust_ch object| google_cust_criteria object| google_cust_gender object| google_cust_id object| google_cust_interests object| google_cust_job object| google_cust_l object| google_cust_lh object| google_cust_u_url object| google_disable_video_autoplay object| google_bfa object| ebfa object| ebfaca object| google_eids object| google_enable_content_recommendations object| google_enable_ose object| google_encoding object| google_font_face object| google_font_size object| google_frame_id object| google_full_width_responsive_allowed object| efwr object| google_full_width_responsive object| gfwroh object| gfwrow object| gfwroml object| gfwromr object| gfwroz object| gfwrnh object| gfwrnwer object| gfwrnher object| google_gl object| google_hints object| google_image_size object| google_kw object| google_kw_type object| google_lact object| google_language object| google_loeid object| google_max_num_ads object| google_max_radlink_len object| google_max_responsive_height object| google_ml_rank object| google_mtl object| google_native_ad_template object| google_native_settings_key object| google_num_radlinks object| google_num_radlinks_per_unit object| google_only_pyv_ads object| google_override_format object| google_page_url object| google_pgb_reactive object| google_pucrd object| google_referrer_url object| google_region object| google_resizing_allowed object| google_resizing_height object| google_resizing_width object| rpe object| google_responsive_formats object| google_responsive_auto_format object| armr object| google_rl_dest_url object| google_rl_filtering object| google_rl_mode object| google_rt object| google_safe object| google_safe_for_responsive_override object| google_scs object| google_source_type object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_tag_origin object| google_tag_partner object| google_targeting object| google_tfs object| google_video_doc_id object| google_video_product_type object| google_video_url_to_fetch object| google_webgl_support object| google_yt_pt object| google_yt_up object| google_package object| google_debug_params object| google_enable_single_iframe object| dash object| google_refresh_count boolean| google_apltlad string| drupal_adsense_cse_lang string| lang object| _gaq object| __SKIM_JS_GLOBAL__ function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy function| Goog_AdSense_getAdAdapterInstance boolean| google_osd_loaded object| _gat function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb function| fbq function| _fbq object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| recaptcha

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
api.skimlinks.mgr.consensu.org
bluehost-cdn.com
cdn.m2osw.com
cdnjs.cloudflare.com
connect.facebook.net
googleads.g.doubleclick.net
images-na.ssl-images-amazon.com
installation.m2osw.com
ir-na.amazon-adsystem.com
linux.m2osw.com
loadeu.exelator.com
maxcdn.bootstrapcdn.com
p.skimresources.com
pagead2.googlesyndication.com
r.skimresources.com
s.skimresources.com
ssl.google-analytics.com
stats.g.doubleclick.net
sync.crwdcntrl.net
t.skimresources.com
ws-na.amazon-adsystem.com
www.facebook.com
www.google.com
www.google.de
www.googletagservices.com
www.gstatic.com
x.skimresources.com
ws-na.amazon-adsystem.com
138.197.205.139
147.75.102.200
151.139.128.10
176.32.100.230
209.197.3.15
2606:4700::6813:c497
2a00:1450:4001:808::2002
2a00:1450:4001:809::200a
2a00:1450:4001:815::2002
2a00:1450:4001:81a::2004
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::2002
2a00:1450:4001:821::2002
2a00:1450:4001:821::2008
2a00:1450:4001:825::2003
2a00:1450:400c:c08::9c
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
35.190.40.172
35.190.59.101
35.201.67.47
52.222.152.207
52.29.153.112
52.51.129.97
52.94.229.212
54.171.6.140
00e53ee2aed52b47c90b70f0c0dfd3c7970b09fb396e53011cc9b3bcb1dee3a7
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07f07e6e07c15081c9ceca4c659f85ddbf65bfc72a389933a86dea411c4d6c75
0c0a009840e8a433ce9b983b0c23fb653b4eae42edbdd6d95376cc0cdfe6c171
0c74c4e497891e92d908560789d3293a4b83573fb761b7d6ade1b589ea2c1838
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
18a5e0dde4d792d27e6c74340155c907dadde7a7d2e81cb4fa422e14308f3dd1
18f126e53d17c5e4384102978d466905fee6ff0550ccd8d6697c9beb0b87f472
19c20a62f086f9418f9e27da6244cc43bd5dcc5cddc7a83b0f4040390a45ead0
2494b59e630043c90be146cc0f164209a32d41b1357d48f9038dada49ecb826a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3c3f6c9880ef9b8affd344b7daae1f46acff13a212194458464909649ac4b0dd
4122adc108e919d986cb016476deda6cb3c8bb61936821114030f517ca74bb9e
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
554a166160fb76785e3395d10012844b8fdceb85d92f11ae9b47bd70f6e8e33d
564a65269d36f4b4c2039b9937ac79352e79af639462bac4988efb650806ad9f
57494356b669bc2e12eac5422c0506a8a9a5b59d608abc785d0bdddb00a07956
57cd04759c3123b5c2ec9f72d0f932377bc4d333fe5112c4b31725cd33073afc
61204a1dcd6d24265b99f72f1f24972c1842474a2479260303a234bafd5001f1
647b3ad97fa34609e2edf234d06e56642e08b912404bd7b2250c47197b9a20bf
657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4
65a9a5d1f785ff2e9b6ab3570dd8e6c3c0ad0b4779f7463d9da7f6562a76e053
661637cb0ba0317f215aacfdb8b3deb04b71087f892feb3016130f5a1b84c4d6
768894b0ab8eef703611a1468246a83a91ba32d574002d63a88ae5c2baf5d52b
77af65266af9d72cd5f79c4477368187c64f0a25966084159a2bd8e4629eb8b5
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7cec930c8706e25c7dddb1c12ebae9580ae10207817d7ff122600e6dae6ec10d
7df3ee05491bfc38f7928e151b5db6fff36134f9a1e414db1758145cae3e2b50
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
945cb21a3fa578c78d0609ac3bf8a0cda2f737740ddb9fe619207024f090540b
95bc9a11600153e14e462613a569c02ea2b757fb8c720a7a1cbfcfe7cbdf45b2
99fd9b57c3cff3d8b16e33e62cc04ec27ac104e2add212a7806829d1f48096e3
9dc2831e02d45903e5393a3b2317fbf7ef133211cccd7e655179498bd759ac44
9e6ebad6ab4f25ec32898f6dbfa6e69009d90a08bddead861a62cb8f5a038cf8
a076a026af0a89e8a3cde2309adc5bfe15404085ffcbe540e7c744af10a80dd1
aa5616a53ab39b3690842b5145c5ad9714df2d58123bb9b6388c2ef95b9ea603
b619d8da2003f5dcb319470461297449a5bf21b17e6b0bb7a489ed329cc8f5e8
b682d14a1b3e6595666c965f7be7be781019878367a02b2955aa7d2e59013baf
b81215a8c84e8fd85821bae3b154c28f98a576e237432030d617069b3bc966d6
c60b15a07d774e3240d2cb5817462e56f09e5ac96aeb2e2ae20a8eb86c904deb
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
d18e24e486ab49d31e5edfa0227469a9d2c499c222a9eab0aa4de34caf355d5d
d2cef591a5a1e42c51317384067223d1014a1db845622b0cb6e5bd23844691f0
db52646425ec36fbb1213fff1967443a7adeb0a84dace31cc51f32ec0b85133f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e24fa457bb25eb15304312497b96b60573b7dd9effa25c7cb8cea5e1dd43fa4d
e35323a96e8a0572bb07cccf3036865a7e52fac491d3a7e24d2e77198fb1adc6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf