www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/Wqf77UJbb0
Effective URL:
https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Submission: On November 18 via api (November 18th 2019, 8:06:36 pm UTC) from US

Summary HTTP 91 Redirects Behaviour Indicators

Summary

This website contacted 28 IPs in 5 countries across 30 domains to perform 91 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER - Twitter Inc.)
1 1	67.199.248.13 67.199.248.13	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD - Google LLC)
1	2.18.233.143 2.18.233.143	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
25	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY - Fastly)
1	2.20.171.216 2.20.171.216	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	72.247.225.98 72.247.225.98	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	2a02:26f0:6c0... 2a02:26f0:6c00:181::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	3.213.170.20 3.213.170.20	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	172.217.23.134 172.217.23.134	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE - Google LLC)
8	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER - Twitter Inc.)
3	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba1b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2606:4700::68... 2606:4700::6810:a20d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	2606:4700::68... 2606:4700::6810:50a5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2606:4700:20:... 2606:4700:20::6819:a222	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	104.96.143.46 104.96.143.46	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	34.248.158.173 34.248.158.173	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY - Fastly)
1	2600:9000:21f... 2600:9000:21f3:b600:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	54.87.95.71 54.87.95.71	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2606:4700:20:... 2606:4700:20::6819:a322	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	23.67.136.71 23.67.136.71	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 2	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2606:4700::68... 2606:4700::6810:51a5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	52.49.153.216 52.49.153.216	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
91	28

1 104.244.42.5 (United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.13 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD - Google LLC, US)
PTR: cname.bitly.com

zd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.143 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-143.deploy.static.akamaitechnologies.com

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.171.216 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-20-171-216.deploy.static.akamaitechnologies.com

c.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.225.98 (United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a72-247-225-98.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:181::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
684dd30d.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.162 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.213.170.20 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-213-170-20.compute-1.amazonaws.com

l.betrad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.134 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s18-in-f134.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 152.199.23.241 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.8 (United States)

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba1b (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

iicbsi-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:a20d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:50a5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::6819:a222 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.96.143.46 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-96-143-46.deploy.static.akamaitechnologies.com

www.everestjs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.248.158.173 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:b600:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.87.95.71 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-87-95-71.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::6819:a322 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

beacon.tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.67.136.71 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-136-71.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.201 (Ascension Island) 2 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:51a5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

api1.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.153.216 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	cbsistatic.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com zdnet4.cbsistatic.com zdnet1.cbsistatic.com	481 KB
8	tiqcdn.com tags.tiqcdn.com	75 KB
7	twitter.com platform.twitter.com syndication.twitter.com	107 KB
6	lightboxcdn.com www.lightboxcdn.com api1.lightboxcdn.com	128 KB
4	ml314.com ml314.com in.ml314.com Failed	14 KB
3	tru.am tru.am beacon.tru.am	14 KB
3	viglink.com cdn.viglink.com api.viglink.com Failed	28 KB
3	twimg.com cdn.syndication.twimg.com pbs.twimg.com	13 KB
3	doubleclick.net securepubads.g.doubleclick.net ad.doubleclick.net	75 KB
3	go-mpulse.net c.go-mpulse.net	49 KB
2	mathtag.com 2 redirects pixel.mathtag.com	1 KB
2	betrad.com l.betrad.com	240 B
2	zdnet.com www.zdnet.com urs.zdnet.com	159 KB
1	akstat.io 684dd30d.akstat.io	354 B
1	adsrvr.org match.adsrvr.org	535 B
1	bluekai.com 1 redirects tags.bluekai.com	858 B
1	chartbeat.net ping.chartbeat.net	168 B
1	chartbeat.com static.chartbeat.com	14 KB
1	cbsinteractive.com vidtech.cbsinteractive.com	281 KB
1	everestjs.net www.everestjs.net	8 KB
1	akamaihd.net iicbsi-a.akamaihd.net	272 B
1	google.com adservice.google.com	171 B
1	google.nl adservice.google.nl	171 B
1	indexww.com js-sec.indexww.com	29 KB
1	evidon.com c.evidon.com	511 B
1	zd.net 1 redirects zd.net	521 B
1	t.co t.co	465 B
0	azurewebsites.net Failed lightboxapi2.azurewebsites.net Failed
0	demdex.net Failed dpm.demdex.net Failed
0	cbsi.com Failed dw.cbsi.com Failed
91	30

	Domain	Requested by
12	zdnet2.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
8	tags.tiqcdn.com	zdnet2.cbsistatic.com tags.tiqcdn.com
6	platform.twitter.com	www.zdnet.com platform.twitter.com
6	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
5	www.lightboxcdn.com	www.zdnet.com www.lightboxcdn.com
4	ml314.com	tags.tiqcdn.com ml314.com www.zdnet.com
4	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
3	cdn.viglink.com	tags.tiqcdn.com www.zdnet.com
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
3	zdnet1.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
2	pbs.twimg.com	www.zdnet.com
2	pixel.mathtag.com	2 redirects
2	tru.am	tags.tiqcdn.com tru.am
2	l.betrad.com	www.zdnet.com
2	securepubads.g.doubleclick.net	www.zdnet.com securepubads.g.doubleclick.net
1	684dd30d.akstat.io	zdnet1.cbsistatic.com
1	match.adsrvr.org	js-sec.indexww.com
1	api1.lightboxcdn.com	www.lightboxcdn.com
1	tags.bluekai.com	1 redirects
1	beacon.tru.am	tru.am
1	ping.chartbeat.net	www.zdnet.com
1	static.chartbeat.com	zdnet2.cbsistatic.com
1	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com
1	www.everestjs.net	tags.tiqcdn.com
1	iicbsi-a.akamaihd.net	tags.tiqcdn.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.nl	securepubads.g.doubleclick.net
1	cdn.syndication.twimg.com	platform.twitter.com
1	syndication.twitter.com	www.zdnet.com platform.twitter.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	ad.doubleclick.net	www.zdnet.com
1	js-sec.indexww.com	www.zdnet.com
1	c.evidon.com	www.zdnet.com
1	www.zdnet.com	t.co
1	zd.net	1 redirects
1	t.co
0	api.viglink.com Failed	cdn.viglink.com
0	lightboxapi2.azurewebsites.net Failed	www.lightboxcdn.com
0	dpm.demdex.net Failed	www.zdnet.com
0	in.ml314.com Failed	ml314.com
0	dw.cbsi.com Failed	tags.tiqcdn.com
91	41

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
*.evidon.com DigiCert ECC Secure Server CA	`2019-02-01` - `2020-05-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
l.betrad.com Go Daddy Secure Certificate Authority - G2	`2019-04-25` - `2021-06-24`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2017-12-12` - `2020-12-15`	3 years	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2020-05-13`	3 years	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-10` - `2020-02-16`	6 months	crt.sh
ssl516460.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-24` - `2020-03-01`	6 months	crt.sh
ssl389962.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-18` - `2020-05-26`	6 months	crt.sh
www.everestjs.net DigiCert SHA2 Secure Server CA	`2018-10-15` - `2020-10-15`	2 years	crt.sh
*.ml314.com Amazon	`2019-03-16` - `2020-04-16`	a year	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2018-12-20` - `2020-01-01`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 6 frames:

Primary Page: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Frame ID: E6221A054AB2C68FB77C049C683DDFF6
Requests: 94 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 57230C18ADF46EFAF1D596B07ADAB624
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html?origin=https%3A%2F%2Fwww.zdnet.com
Frame ID: 8475B7D6D8CECF1B16D4906F57A907D3
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574107589625&lv=1
Frame ID: 1539FB694EB9794CB62EB824705DDC8E
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnasty-php7-remote-code-execution-bug-exploited-in-the-wild%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
Frame ID: C10F5DAADD55DE43B5A2077F5450A513
Requests: 1 HTTP requests in this frame

Frame: https://syndication.twitter.com/i/jot
Frame ID: FC38B94D073282F5C003B176B2FE9D6B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/Wqf77UJbb0 Page URL
https://zd.net/2KuapCh HTTP 301
https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/ Page URL

Page Statistics

91
Requests

89 %
HTTPS

40 %
IPv6

30
Domains

41
Subdomains

28
IPs

5
Countries

1475 kB
Transfer

5185 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/Wqf77UJbb0 Page URL
https://zd.net/2KuapCh HTTP 301
https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79

https://tags.bluekai.com/site/20486?limit=0&id=3606146128957407316&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3606146128957407316%26eid=50056 HTTP 302
https://ml314.com/csync.ashx?fp=3TaH%2Fy9999e935J5&person_id=3606146128957407316&eid=50056

Request Chain 80

https://idsync.rlcdn.com/395886.gif?partner_uid=3606146128957407316 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNjE0NjEyODk1NzQwNzMxNhAAGg0IxfPL7gUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=ffbfc032898a81e62192406dcda21d11c00dd45a01214666bd20a03d3ad5d662f4cb09cee1a4f8eb&person_id=3606146128957407316&eid=50082

Request Chain 81

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606146128957407316%26eid=50220 HTTP 302
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606146128957407316%26eid=50220&mm_bnc&mm_bct&UUID=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86 HTTP 302
https://ml314.com/csync.ashx?fp=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86&person_id=3606146128957407316&eid=50220

Request Chain 82

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606146128957407316 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606146128957407316 HTTP 302
https://ml314.com/csync.ashx?fp=d5571d7f493b9103cf44e93270984493&eid=50146&person_id=3606146128957407316

Request Chain 83

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2jt3BpOZqGY0F4vHtha80ne9r-zpcdAkYKaRLiUyevB0&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil

91 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Wqf77UJbb0 Show response
t.co/ 221 B
465 B 23636ms
159ms Document
text/html 104.244.42.5
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/Wqf77UJbb0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

22f71c21eb2309397ddaece26f9c16c1b282969a63ae3dce4aee8f98ff66401e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /Wqf77UJbb0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
cache-control: private,max-age=300
content-encoding: gzip
content-length: 173
content-type: text/html; charset=utf-8
date: Mon, 18 Nov 2019 20:06:22 GMT
expires: Mon, 18 Nov 2019 20:11:21 GMT
server: tsa_o
set-cookie: muc=98213bd4-e00a-4ee5-b994-6c7fc9aa6936; Max-Age=63072000; Expires=Wed, 17 Nov 2021 20:06:21 GMT; Domain=t.co
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: d63e97b22555e0ec2a60ca59f3d55524
x-response-time: 124
x-xss-protection: 0

GET
H2

200

Primary Request / Show response
www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Redirect Chain

https://zd.net/2KuapCh
https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

472 KB
108 KB

6537ms
6471ms

Document
text/html

2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Requested by

Host: t.co
URL: https://t.co/Wqf77UJbb0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4dc1b4519a10e5fa6c35ea646267726e2198ecb52d0862f05aea5d30b8a9c4e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://t.co/Wqf77UJbb0
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://t.co/Wqf77UJbb0

Response headers

status: 200
server: nginx
content-type: text/html; charset=UTF-8
cache-control: max-age=5400, private
x-tx-id: 0cb47e59-ddb8-4c3a-a24c-80ce053b66c9
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
expires: Mon, 18 Nov 2019 21:36:23 GMT
last-modified: Mon, 18 Nov 2019 20:06:23 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
accept-ranges: bytes
date: Mon, 18 Nov 2019 20:06:23 GMT
set-cookie: fly_device=desktop; expires=Mon, 25-Nov-2019 20:06:23 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "nl"}; expires=Mon, 25-Nov-2019 20:06:23 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload

Redirect headers

Cache-Control: private, max-age=90
Content-Length: 176
Content-Security-Policy: referrer always;
Content-Type: text/html; charset=utf-8
Date: Mon, 18 Nov 2019 20:06:22 GMT
Location: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Referrer-Policy: unsafe-url
Server: nginx
Set-Cookie: _bit=jaik6m-d9fe45888a3ebc6504-00Q; Domain=zd.net; Expires=Sat, 16 May 2020 20:06:22 GMT
Strict-Transport-Security: max-age=1209600
Connection: close

GET
H2 200 main-7e4e5d35ca-rev.css
zdnet2.cbsistatic.com/fly/1860-fly/css/core/ 344 KB
62 KB 23ms
6ms Stylesheet
text/css 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0dd96e4c2618b847e44b23e56ab9ca48410e53a21d35a5dbed55526d6fdf9cd5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36018
status: 200
strict-transport-security: max-age=31536000
content-length: 63660
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Nov 2019 09:21:40 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dd262a4-55e0f"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 10:06:10 GMT

GET
H2 200 controls-ade16878b9-rev.css
zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/ 17 KB
4 KB 22ms
5ms Stylesheet
text/css 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ade16878b9-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

76d54e3e54e9e510919a16e465341bfa77820a8e10f52b8ccb2064580b4f58c4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36017
status: 200
strict-transport-security: max-age=31536000
content-length: 3687
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Nov 2019 09:21:51 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dd262af-4408"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 10:06:11 GMT

GET
H2 200 evidon-sitenotice-tag.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 69 KB
14 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 403878
status: 200
strict-transport-security: max-age=31536000
content-length: 13960
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Nov 2019 16:36:32 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcc3110-1134e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Nov 2019 03:55:10 GMT

GET
H2 200 country.js Show response
c.evidon.com/geo/ 260 B
511 B 64ms
20ms Script
application/x-javascript 2.20.171.216
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/country.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.171.216 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-20-171-216.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
last-modified: Wed, 30 May 2018 22:22:39 GMT
server: AkamaiNetStorage
access-control-allow-origin
etag: "8d3bb7b8708f6911ebe937e111b09ec4:1527718959"
access-control-max-age: 86400
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
status: 200
accept-ranges: bytes
access-control-allow-headers: *
content-length: 260

GET
H2 200 snthemes.js Show response
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 94 KB
8 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 412845
status: 200
strict-transport-security: max-age=31536000
content-length: 7763
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Nov 2019 16:36:32 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcc3110-177f3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Nov 2019 01:25:43 GMT

GET
H2 200 settings.js Show response
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 33 KB
2 KB 7ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57942
status: 200
strict-transport-security: max-age=31536000
content-length: 1669
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 19:35:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcdac89-828e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 04:00:47 GMT

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 910 B
1 KB 6ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
x-content-type-options: nosniff
age: 4702260
status: 200
nncoection: close
strict-transport-security: max-age=31536000
content-length: 910
x-xss-protection: 1; mode=block
last-modified: Mon, 03 Sep 2018 02:32:23 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Sep 2020 09:53:51 GMT

GET
H2 200 php.png
zdnet2.cbsistatic.com/hub/i/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/f012e605ffc8c4319a9923f1cddcf320/ 4 KB
3 KB 7ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/f012e605ffc8c4319a9923f1cddcf320/php.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

93186c254a44cae276e2c5b92fd902fb3d91a52c34d1e5b9aceab13855884401

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2034336
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 3016
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "3bcf6eecb2611212e088d0d91f2ade9c"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gallery-ansible.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/04/11/2f40e47f-ad7c-4cfe-b491-20fc67c13d9d/thumbnail/170x128/671f950f4355142bdd44015ec488f4c4/ 6 KB
6 KB 7ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/04/11/2f40e47f-ad7c-4cfe-b491-20fc67c13d9d/thumbnail/170x128/671f950f4355142bdd44015ec488f4c4/gallery-ansible.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

490e4bfc694eb831ba439b5d5decbe1b488391681ee6424fa439683a4e4dc095

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7802966
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 6399
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "0b7a9d54deeb611edc4540d286e9a042"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gallery-capistrano.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/04/11/53a92ced-1684-4a2c-87d6-18934171588a/thumbnail/170x128/ec27141866f1c646de12308941d6f9ef/ 6 KB
6 KB 15ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/04/11/53a92ced-1684-4a2c-87d6-18934171588a/thumbnail/170x128/ec27141866f1c646de12308941d6f9ef/gallery-capistrano.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4dabcf86a321e132330448c63a36d88816c4f633896650bf2231e0a074d9f0d9

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2921353
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 6017
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "eb2e9dffe58d635b7d72e99c8e61b5f2"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gallery-docker.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/04/11/9b12f043-817b-483d-a129-7acb6f7f1f48/thumbnail/170x128/360989bccae6160cdd934d50aca8a96a/ 6 KB
6 KB 7ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/04/11/9b12f043-817b-483d-a129-7acb6f7f1f48/thumbnail/170x128/360989bccae6160cdd934d50aca8a96a/gallery-docker.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

723a9ea05d1491d99d5defcd6db01a8c9fb50b583e69889abad120b0a74a2c2a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4705092
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 6575
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "a85edfa24307bad582dbfb9713d7eb6b"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gallery-ganglia.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/04/11/dd3ce6e3-2e64-473c-a610-92c855e71795/thumbnail/170x128/117e514c57ebf88afc4203eedfda75d1/ 8 KB
8 KB 15ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/04/11/dd3ce6e3-2e64-473c-a610-92c855e71795/thumbnail/170x128/117e514c57ebf88afc4203eedfda75d1/gallery-ganglia.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4b6d022516b48072704aeeb407e2d557568647087feefa57f1b216abcd49c171

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2112914
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 7912
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "3dcaf04c357c577a857f3ffadc555f9b"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gallery-gradle.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/04/11/91018dfe-2957-44c0-804c-d4867d4191f8/thumbnail/170x128/026e49c23ae588258e7923b3d853fd2b/ 9 KB
9 KB 7ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/04/11/91018dfe-2957-44c0-804c-d4867d4191f8/thumbnail/170x128/026e49c23ae588258e7923b3d853fd2b/gallery-gradle.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3a18cc29d89287ebb9fa636217661fa8879a33f91abe2ff4e730fd1065d526c7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4056906
status: 200
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
content-length: 8819
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "1d7b813d77ada92b4c5998ec42a3cde9"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/1860-fly/js/libs/ 16 KB
6 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36017
status: 200
strict-transport-security: max-age=31536000
content-length: 6305
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Nov 2019 09:21:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dd262a1-3f09"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 10:06:10 GMT

GET
H2 200 en.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/ 311 KB
14 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 320116
status: 200
strict-transport-security: max-age=31536000
content-length: 14353
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 19:39:36 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcdad78-4ddff"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Nov 2019 03:11:13 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 mag-white01.png
zdnet3.cbsistatic.com/fly/1574068713-fly/bundles/zdnetcss/images/core/ 1 KB
1 KB 8ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1574068713-fly/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36014
status: 200
strict-transport-security: max-age=31536000
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Nov 2019 09:18:33 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dd261e9-4f1"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 10:06:13 GMT

GET
H2 200 Raleway-Bold.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 51 KB
51 KB 31ms
17ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css
Origin: https://www.zdnet.com

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
x-content-type-options: nosniff
age: 10807176
status: 200
nncoection: close
strict-transport-security: max-age=31536000
content-length: 52212
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-cbf4"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 Raleway-Light.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 20ms
6ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css
Origin: https://www.zdnet.com

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
x-content-type-options: nosniff
age: 10807175
status: 200
strict-transport-security: max-age=31536000
content-length: 51608
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-c998"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 Raleway-Regular.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
50 KB 31ms
17ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css
Origin: https://www.zdnet.com

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
x-content-type-options: nosniff
age: 10261349
status: 200
strict-transport-security: max-age=31536000
content-length: 51572
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jul 2019 16:01:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d35dde5-c974"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jul 2020 01:11:57 GMT

GET
H2 200 logo.png
zdnet2.cbsistatic.com/fly/1574068713-fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1574068713-fly/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet2.cbsistatic.com/fly/1860-fly/css/core/main-7e4e5d35ca-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38089
status: 200
strict-transport-security: max-age=31536000
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 19:35:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcdac89-1009"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 09:26:44 GMT

GET
H2 200 vendorlist.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 113 KB
51 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185473
status: 200
strict-transport-security: max-age=31536000
content-length: 52305
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 19:39:36 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcdad78-1c3b9"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2019 16:35:13 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/1860-fly/js/ 209 KB
69 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/1860-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

371678c738b3bbea36b32d7cb5b0b4d14182ee51ac165ae7ae45f6dc78c29a3d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36016
status: 200
strict-transport-security: max-age=31536000
content-length: 70828
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Nov 2019 09:21:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dd262a2-343aa"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2019 10:06:11 GMT

GET
H/1.1 200
OK ls-zdnet.js Show response
js-sec.indexww.com/ht/ 94 KB
29 KB 697ms
640ms Script
text/javascript 72.247.225.98
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.98 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a72-247-225-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Mon, 18 Nov 2019 20:05:57 GMT
Server: Apache
ETag: "da1252-176c0-597a479c6e28e"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 29092
Expires: Mon, 18 Nov 2019 21:06:29 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame 5723 187 KB
47 KB 22ms
8ms Script
application/javascript 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: br
Last-Modified: Tue, 12 Nov 2019 10:04:32 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 47928

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 51 KB
16 KB 102ms
56ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

10e3f0e1055b3fddce20d3709a959c956fc5fed562af715f9a419615c287cbbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "341 / 568 of 1000 / last-modified: 1574096821"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15663
x-xss-protection: 0
expires: Mon, 18 Nov 2019 20:06:29 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 26ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4195) /
Resource Hash: f5b5ac5fdb8870504505be0a9522061f905e5c1b25a927f877303785129cb3f9

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 23:03:20 GMT
Server: ECS (fcn/4195)
Etag: "dbb5834a50c19a7a8e3ad3ae8f1c1329+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28705

GET
H2 200 evidon-banner.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 8 KB
3 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484999
status: 200
strict-transport-security: max-age=31536000
content-length: 2440
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Nov 2019 15:33:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc97f47-1faf"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2019 05:23:04 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/8/1/2/2/ 0
120 B 405ms
105ms Image
text/plain 3.213.170.20
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/8/1/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.170.20 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-213-170-20.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status: 204
date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by: Express
vary: Accept-Encoding

GET
H2 200 ;ord=1574107589249
ad.doubleclick.net/ddm/ad/lphqlyyimu/mxi/qpvatzexgp/okvy/ 43 B
595 B 76ms
30ms Image
image/gif 172.217.23.134
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/lphqlyyimu/mxi/qpvatzexgp/okvy/;ord=1574107589249?

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.134 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f134.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Nov 2019 20:06:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/8/4/2/2/ 0
120 B 378ms
104ms Image
text/plain 3.213.170.20
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/8/4/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.170.20 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-213-170-20.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status: 204
date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by: Express
vary: Accept-Encoding

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 399ms
116ms Script
application/javascript 35.190.38.167
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H/1.1 200
OK widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html
platform.twitter.com/widgets/ Frame 8475 0
0 7ms
6ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html?origin=https%3A%2F%2Fwww.zdnet.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40B4) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 18 Nov 2019 20:06:29 GMT
Etag: "7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified: Tue, 22 Oct 2019 22:27:25 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40B4)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5816

GET
H2 200 scrolling-mpu-22779a851e-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 956 B
598 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445517
status: 200
strict-transport-security: max-age=31536000
content-length: 491
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Nov 2019 15:52:36 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5dcc26c4-3bc"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2019 16:21:12 GMT

GET
H/1.1 200
OK moment~timeline~tweet.f41b02dcb58512d8e9f6d4178eb28452.js Show response
platform.twitter.com/js/ 24 KB
8 KB 6ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.f41b02dcb58512d8e9f6d4178eb28452.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E1) /
Resource Hash: 7c46604c0440be3fd2d6a5e217846cde699e81422afd52625b633bc28cfe3446

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:17 GMT
Server: ECS (fcn/40E1)
Etag: "acaa80339e9cea48739803700d80ebfb+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7914

GET
H/1.1 200
OK tweet.25ae5aee3c2602da5d36fbf6c51215cf.js Show response
platform.twitter.com/js/ 19 KB
7 KB 12ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/tweet.25ae5aee3c2602da5d36fbf6c51215cf.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41AD) /
Resource Hash: bd13404866644f19bfd9bb0d8c96f58536885414ba14fcae712da48d22e74631

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:17 GMT
Server: ECS (fcn/41AD)
Etag: "e76dffef1c1edce4c8dc5febdf76528c+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 6322

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 94 KB
19 KB 251ms
29ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8DD6) /
Resource Hash: b2d552c0df8b25867ece11ae83f61fe132599d8307bac5d5ba743b2378d2cb1d

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Wed, 13 Nov 2019 18:23:50 GMT
server: ECAcc (lha/8DD6)
etag: "2764937052"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 19470
expires: Mon, 18 Nov 2019 20:11:29 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 5723 2 KB
1 KB 51ms
37ms XHR
application/json 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5247025&v=1.571.0&if=&sl=0&si=72t68vg9xld-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 82c188f1e0364d9c5a0b07b51e9bbdceb139d17839498d65a1384a302eeb6f9f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 700

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
338 B 457ms
433ms Image
image/gif 104.244.42.8
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1574107589330%2C%22dnt%22%3Afalse%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 0
x-response-time: 157
pragma: no-cache
last-modified: Mon, 18 Nov 2019 20:06:29 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 3c0717ee12348c589c38b63c5e157ff7
x-transaction: 0035aa5f000a2c52
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 tweets.json Show response
cdn.syndication.twimg.com/ 6 KB
2 KB 612ms
611ms Script
application/javascript 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/tweets.json?callback=__twttr.callbacks.cb0&ids=1187267849238335488&lang=en&suppress_response_codes=true&theme=light&tz=GMT%2B0100

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

tsa_f /

Resource Hash

6d882ff14a4e92b34ee7447c70342e3fb51fcc83c58bef39834cac4d046b1f1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-disposition: attachment; filename=jsonp.jsonp
strict-transport-security: max-age=631138519
content-length: 1669
x-xss-protection: 0
x-response-time: 128
last-modified: Mon, 18 Nov 2019 20:06:29 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=60
x-connection-hash: 841c2fed74aa3a96085cff998a98aec8
timing-allow-origin: *
x-transaction: 006908e800241562
expires: Mon, 18 Nov 2019 20:07:29 GMT

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 109 B
171 B 31ms
15ms Script
application/javascript 2a00:1450:4001:814::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:814::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019111401.js Show response
securepubads.g.doubleclick.net/gpt/ 159 KB
58 KB 167ms
167ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

7aee25147e91ea27917ac5cfd8ea30fdcae0e6b1072e51a1d644dafb76ab5c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 14 Nov 2019 14:12:07 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 59644
x-xss-protection: 0
expires: Mon, 18 Nov 2019 20:06:29 GMT

GET
H/1.1 200
OK isInternalUser.js Show response
iicbsi-a.akamaihd.net/common/js/esi/ 22 B
272 B 37ms
6ms Script
application/x-javascript 2a02:26f0:6c00::210:ba1b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00::210:ba1b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Cache-Control: max-age=221815
Server: AkamaiNetStorage
Connection: keep-alive
ETag: "fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length: 22
Content-Type: application/x-javascript

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
28 KB 57ms
22ms Script
text/javascript 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2418766
status: 200
content-type: text/javascript
content-length: 27746
x-amz-id-2: XaZZfksc5tY2QYKqWg2l9SF0g4tYYLB4/OoiMCVw8qhEZI1HOeFOpmyjOyB6h9h9/hQcx65+CBU=
last-modified: Mon, 21 Oct 2019 20:13:23 GMT
server: cloudflare
etag: "df893ab92782cedac4da4785df9ec68e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CED68FA43CA7DB4B
cache-control: public, max-age=1800
accept-ranges: bytes
cf-ray: 537c90b33ee0cbc0-VIE
expires: Mon, 18 Nov 2019 20:36:29 GMT

GET
H2 200 utag.1779.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 3 KB
2 KB 31ms
30ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D41) /
Resource Hash: cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:57 GMT
server: ECAcc (lha/8D41)
etag: "392561602+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1785
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1782.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 46ms
46ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8DED) /
Resource Hash: 791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Mon, 29 Oct 2018 17:20:42 GMT
server: ECAcc (lha/8DED)
etag: "3447796852"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1071
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1787.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 142 KB
48 KB 31ms
31ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911131823
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8C97) /
Resource Hash: cdd64e5652c18bfd813e4c6adfd0d2c030bcf0c4730ac94cb6371e79cfc6f7c0

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Wed, 13 Nov 2019 18:23:50 GMT
server: ECAcc (lha/8C97)
etag: "1483923147"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 48594
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1790.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
957 B 46ms
46ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D49) /
Resource Hash: 10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (lha/8D49)
etag: "2267415266"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 872
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1791.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 47ms
46ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D62) /
Resource Hash: 7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (lha/8D62)
etag: "3334871598"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1196
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1792.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 4 KB
2 KB 45ms
45ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8C92) /
Resource Hash: dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2016 14:28:47 GMT
server: ECAcc (lha/8C92)
etag: "2022868805"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1664
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 utag.1797.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
972 B 47ms
46ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D56) /
Resource Hash: 3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
last-modified: Wed, 25 Jan 2017 20:07:58 GMT
server: ECAcc (lha/8D56)
etag: "1907756232+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 883
expires: Tue, 03 Dec 2019 20:06:29 GMT

GET
H2 200 lightbox.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 1539 326 B
549 B 53ms
21ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574107589625&lv=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b4a3d1551c7f6d704c039c803f2cb25d93939c4e8082c5d33b3f23caf54ab2b3

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 593565
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 537c90b36fe4cbc0-VIE

GET anonc.js
dw.cbsi.com/ 0
0

GET ds.js
dw.cbsi.com/js/cbsi/ 0
0

GET
H2 200 cbsinteractive.js Show response
tru.am/scripts/custom/ 3 KB
1 KB 67ms
22ms Script
text/javascript 2606:4700:20::6819:a222
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/custom/cbsinteractive.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 1133
status: 200
x-guploader-uploadid: AEnB2UpMwaUnu5etTWUb3qoXtLVIFnaIpAwCwBuyFQKb9FZldWeW4IwPutA8bkurTIwLkR5Lg3hVxIIfP-YsWesSnz04bEzAYA
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
last-modified: Tue, 30 Apr 2019 19:32:26 GMT
server: cloudflare
etag: W/"c486c91d1321adf59073588524182108"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
content-type: text/javascript
x-goog-generation: 1556652746634603
cache-control: public, max-age=86400
x-goog-stored-content-length: 2725
cf-ray: 537c90b3adec8cc2-VIE
expires: Mon, 18 Nov 2019 20:47:36 GMT

GET
H/1.1 200
OK st.v3.js Show response
www.everestjs.net/static/ 25 KB
8 KB 111ms
37ms Script
application/x-javascript 104.96.143.46
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/st.v3.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.96.143.46 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-96-143-46.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 364efc68e57240e144c1334b7b4e77dcac0dc65d71777b38992f6cd8ffc67b73

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Nov 2019 14:50:09 GMT
Server: Apache
ETag: "1ff0663-64fd-596866ea656d9"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=24436
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7335
Expires: Tue, 19 Nov 2019 02:53:45 GMT

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 148ms
41ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?18102019
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:28 GMT
Content-Encoding: gzip
Last-Modified: Mon, 18 Nov 2019 08:14:58 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=43708
Connection: keep-alive
Content-Length: 11932
Expires: Tue, 19 Nov 2019 08:14:58 GMT

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
264 B 24ms
24ms Image
image/gif 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=4.844003491442605
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
cf-cache-status: HIT
age: 7
status: 200
content-type: image/gif
content-length: 43
x-amz-id-2: OcY4cyGEBfGf5CYFy/mSlLaudm1wRF7bVWgegqU3WDAeBaAd2Ik4ApKJNXfUSZTdffCJWTPsdWs=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 4F01AF13FD1D7BB8
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 537c90b37803cbc0-VIE

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
103 B 30ms
30ms Image
image/gif 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=4.844003491442605
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
cf-cache-status: HIT
age: 7
status: 200
content-type: image/gif
content-length: 43
x-amz-id-2: OcY4cyGEBfGf5CYFy/mSlLaudm1wRF7bVWgegqU3WDAeBaAd2Ik4ApKJNXfUSZTdffCJWTPsdWs=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 4F01AF13FD1D7BB8
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 537c90b37807cbc0-VIE

GET
H2 200 user.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 1539 765 KB
125 KB 21ms
21ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637091106088383370
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574107589625&lv=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82bbafe6f10665c303950cee83918e548ed3048f21062fd2b79d00d67a89bd01

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: L28yRUQu8FZzxMomJSK6sQ==
age: 593564
cf-polished: origSize=1203760
status: 200
x-ms-lease-status: unlocked
last-modified: Mon, 11 Nov 2019 23:10:08 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 3f9b2a75-801e-0015-7de5-989758000000
expires: Tue, 17 Nov 2020 20:06:29 GMT
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 537c90b3987fcbc0-VIE
cf-bgj: minify

GET
H2 200 article-dc173c6bd0-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 162 KB
45 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-dc173c6bd0-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

86385663e668c7cd9e9eefe2169e64a1e6bc68c6da5bd3932600dc058cbb8135

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 365077
status: 200
strict-transport-security: max-age=31536000
content-length: 46332
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 14:31:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcd653e-287b2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Nov 2019 14:41:52 GMT

GET
H2 200 ta-pagesocial-sdk.js Show response
tru.am/scripts/ 35 KB
12 KB 23ms
23ms Script
application/javascript 2606:4700:20::6819:a222
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by: Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 1577
status: 200
x-guploader-uploadid: AEnB2UpHkBTHB689lYV1yYwWZdCKlriJjG6xI09p3M1TlENy8g1m9vT3-UExXnjjjrwKnuzo-r_LBD53Cfuk7x8341CvruUplQ
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
last-modified: Fri, 19 Apr 2019 06:14:55 GMT
server: cloudflare
etag: W/"942d5ae1e512ccdf18813550428dd002"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=O7AZFg==, md5=lC1a4eUSzN8YgTVQQo3QAg==
content-type: application/javascript
x-goog-generation: 1555654495662585
cache-control: public, max-age=86400
x-goog-stored-content-length: 35540
cf-ray: 537c90b3de048cc2-VIE
expires: Mon, 18 Nov 2019 20:40:12 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 230ms
26ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
age: 1944194
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by: cache-dca17783-DCA, cache-fra19153-FRA
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1574107590.948449,VS0,VE0
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: F767A360D0453B01
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 3, 11

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 35 KB
14 KB 30ms
13ms Script
application/x-javascript 2600:9000:21f3:b600:18:1fcd:349:ca21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b600:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 18:24:55 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 02:24:02 GMT
server: nginx
age: 6093
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 1afL8OqrddAjbA69u0b4VgJN_mt6_dy69KEL9StfzmkQgJQf2G_mCg==
via: 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront)
expires: Mon, 18 Nov 2019 20:24:55 GMT

GET
H2 200 fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/ 4 KB
1 KB 20ms
19ms Stylesheet
text/css 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637091106076939970
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637091106088383370
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: q4B4xYJoZwx9ikt94o1nCA==
age: 593562
cf-polished: origSize=6016
x-ms-meta-cbmodifiedtime: Wed, 10 Apr 2019 18:50:43 GMT
status: 200
x-ms-lease-status: unlocked
last-modified: Wed, 10 Apr 2019 19:06:17 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: 301ad383-b01e-00b7-41e5-985ac4000000
expires: Tue, 17 Nov 2020 20:06:29 GMT
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 537c90b3fa2bcbc0-VIE
cf-bgj: minify

GET
H2 200 ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame C10F 0
0 22ms
22ms Document
text/html 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnasty-php7-remote-code-execution-bug-exploited-in-the-wild%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637091106088383370
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.lightboxcdn.com
:scheme: https
:path: /lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnasty-php7-remote-code-execution-bug-exploited-in-the-wild%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
accept-encoding: gzip, deflate, br
cookie: __cfduid=d0f4081ccd2450f0c17b75174b59b75cb1574107589
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Response headers

status: 200
date: Mon, 18 Nov 2019 20:06:29 GMT
content-type: text/html
content-md5: xa1/rdPe0J6SwxlD7atkzw==
last-modified: Mon, 11 Nov 2019 23:10:07 GMT
x-ms-request-id: 82f0e3ca-001e-0026-72dc-9dce75000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
cf-cache-status: HIT
age: 47657
expires: Tue, 17 Nov 2020 20:06:29 GMT
cache-control: public, max-age=31536000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 537c90b41a8ecbc0-VIE
content-encoding: br

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
256 B 15ms
15ms Image
image/gif 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1574107589752&h=www.zdnet.com&e=p&u=40913
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 18 Nov 2019 20:06:29 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 1515912
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 537c90b41a8bcbc0-VIE
cf-bgj: imgq:85

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 12 KB
5 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1860-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 280011
status: 200
strict-transport-security: max-age=31536000
content-length: 4877
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Nov 2019 19:39:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dcdad7a-2fdf"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Nov 2019 14:19:37 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 323ms
113ms Image
image/gif 54.87.95.71
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fnasty-php7-remote-code-execution-bug-exploited-in-the-wild%2F&u=C3l6XkCTBcPvDEUGuQ&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=3318&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=https%3A%2F%2Ft.co%2FWqf77UJbb0&b=7757&t=CNRw-nBVt3-6DDrdZkBG8EbxBB6HDS&V=118&i=Nasty%20PHP7%20remote%20code%20execution%20bug%20exploited%20in%20the%20wild%20%7C%20ZDNet&tz=-60&_acct=anon&sn=1&sv=DzqpYMBCgg1TCTwwCTDkQ7rSBAgrWl&sr=https%3A%2F%2Ft.co%2FWqf77UJbb0&sd=1&im=067b2ff3&_
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.87.95.71 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-87-95-71.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Mon, 18 Nov 2019 20:06:30 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 43
content-type: image/gif

POST
H2 200 beacon
beacon.tru.am/ 0
0 211ms
168ms Fetch 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.tru.am/beacon
Requested by: Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 18 Nov 2019 20:06:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, private, max-age=0
cf-ray: 537c90b499dfcba0-VIE
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 35ms
34ms XHR
application/json 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1574107589815&s=48cd764ecd4d2a40c2529f9774489414abb4881d0816828e2f71fd680c03cd10
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: c81e2b59aeb1521bfab865dd23e8de784fa284a0c3ecfc1ead406e1d4d61c18d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 741

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 906 B
1 KB 37ms
37ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnasty-php7-remote-code-execution-bug-exploited-in-the-wild%2F&pv=1574107589817_gmrjg72ct&bl=en-us&cb=5125369&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1574107589817_gmrjg72ct&cid=7a77f4ea-261d-4555-956a-807ea5bd9318&s=1600x1200&rp=https%3A%2F%2Ft.co%2FWqf77UJbb0
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?18102019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c8a1d34850735ed9223b2b239195bd5532a75dba793bd0e3f1f4af609c81ae61

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 18 Nov 2019 20:06:28 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 521
Expires: 0

GET ud.ashx
in.ml314.com/ 0
0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://tags.bluekai.com/site/20486?limit=0&id=3606146128957407316&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3606146128957407316%26eid=50056
https://ml314.com/csync.ashx?fp=3TaH%2Fy9999e935J5&person_id=3606146128957407316&eid=50056

43 B
312 B

40ms
40ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=3TaH%2Fy9999e935J5&person_id=3606146128957407316&eid=50056
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 19 Nov 2019 15:06:30 GMT

Redirect headers

Location: https://ml314.com/csync.ashx?fp=3TaH%2Fy9999e935J5&person_id=3606146128957407316&eid=50056
Date: Mon, 18 Nov 2019 20:06:30 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: 5dee
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3606146128957407316
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNjE0NjEyODk1NzQwNzMxNhAAGg0IxfPL7gUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=ffbfc032898a81e62192406dcda21d11c00dd45a01214666bd20a03d3ad5d662f4cb09cee1a4f8eb&person_id=3606146128957407316&eid=50082

0
0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606146128957407316%26eid=50220
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606146128957407316%26eid=50220&mm_bnc&mm_bct&UUID=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86
https://ml314.com/csync.ashx?fp=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86&person_id=3606146128957407316&eid=50220

43 B
312 B

36ms
35ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86&person_id=3606146128957407316&eid=50220
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 19 Nov 2019 15:06:30 GMT

Redirect headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Server: MT3 1913 979072d master zrh-pixel-x17
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ml314.com/csync.ashx?fp=4f635dd2-ecc4-4a00-b5a7-6fb2586aaf86&person_id=3606146128957407316&eid=50220
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Mon, 18 Nov 2019 20:06:28 GMT

GET

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606146128957407316
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606146128957407316
https://ml314.com/csync.ashx?fp=d5571d7f493b9103cf44e93270984493&eid=50146&person_id=3606146128957407316

0
0

GET

utsync.ashx
ml314.com/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2jt3BpOZqGY0F4vHtha80ne9r-zpcdAkYKaRLiUyevB0&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil

0
0

GET ibs:dpid=22052&dpuuid=3606146128957407316&redir=
dpm.demdex.net/ 0
0

GET z
lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/ 0
0

GET
H2 200 z.gif Show response
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkEA2AJToAggAc5UegHV6AIwDSEIkgDMAdmS7xWDQAkAKsAAyAGnRQIAa3roA4vVxOQ0gMLkAJxAAW3p4fQAONCMATlQRZBj9dA5Y... 182 B
575 B 65ms
19ms XHR
application/javascript 2606:4700::6810:51a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkEA2AJToAggAc5UegHV6AIwDSEIkgDMAdmS7xWDQAkAKsAAyAGnRQIAa3roA4vVxOQ0gMLkAJxAAW3p4fQAONCMATlQRZBj9dA5YADNYAIg9Q2MgA___XZX/z.gif
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637091106088383370
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:51a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 03532814821f169f4c4bc775fc12dc3e79d20d73efcb9a8d278bd8756c6e6ebf

Request headers

Accept: */*
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 85671
x-powered-by: ASP.NET
status: 200
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
access-control-allow-credentials: true
cf-ray: 537c90b52dbfcbcc-VIE
expires: Tue, 19 Nov 2019 20:06:29 GMT

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
535 B 102ms
34ms XHR
application/json 52.49.153.216
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.153.216 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f8e130623183629519cd4682c962f9b9f56edf85d47c2ba9b2898583a0f9895b

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 18 Nov 2019 20:06:29 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Wed, 18 Dec 2019 20:06:29 GMT

GET
H/1.1 200
OK tweet.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ 51 KB
12 KB 6ms
6ms Stylesheet
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/tweet.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40FC) /
Resource Hash: 458031c1beb286b351738608cbd8513550fb9f1330a80c9b3a31ef43edde2028

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:14 GMT
Server: ECS (fcn/40FC)
Etag: "280518989f85e11c9f154ac8f0c806ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 11430

GET
H/1.1 200
OK tweet.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ 51 KB
51 KB 7ms
6ms Image
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/tweet.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40FD) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Mon, 18 Nov 2019 20:06:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:14 GMT
Server: ECS (fcn/40FD)
Etag: "280518989f85e11c9f154ac8f0c806ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 11430

POST ping
api.viglink.com/api/ 0
0

GET
H2 200 4gU3P-Fa_normal.jpg
pbs.twimg.com/profile_images/1024230522396893184/ 2 KB
3 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1024230522396893184/4gU3P-Fa_normal.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41AC) /

Resource Hash

0bca2eedd443a8b8dfe138e9c9467e6b76de7f60d69495bae8f949e689e9cbf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:30 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2415
x-response-time: 123
surrogate-key: profile_images profile_images/bucket/8 profile_images/1024230522396893184
last-modified: Tue, 31 Jul 2018 09:47:20 GMT
server: ECS (fcn/41AC)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: b873398e9a1c1a683dcde9f358a05adb
accept-ranges: bytes

GET
H2 200 EHoFvRgXYAAw8OZ
pbs.twimg.com/media/ 8 KB
9 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EHoFvRgXYAAw8OZ?format=jpg&name=small

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40AE) /

Resource Hash

e5bd32899e67fa7c88b01ccae606bc29b05993bd892756f7c097448e27b47981

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Mon, 18 Nov 2019 20:06:30 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 8576
x-response-time: 141
surrogate-key: media media/bucket/9 media/1187267761476689920
last-modified: Thu, 24 Oct 2019 07:19:07 GMT
server: ECS (fcn/40AE)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d1cbf43204106e1dc06cc7d2b0ee83e8
accept-ranges: bytes

GET
DATA 200
OK truncated
/ 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 512 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49c2a3cf0f363bf387c06a35a4a4e6c7255799b3776bed55914862136d783028

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 600 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c50a17e8272b9359e4b62e0f305e201f359cb5bd2245671c115d031f2b7f68d0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 323 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1 204
No Content / Show response
684dd30d.akstat.io/ 0
354 B 50ms
35ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd30d.akstat.io/?h.pg=article&when=1574107590231&t_other=custom4%7C6945&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=7145a41764de7e6bc15a804711ac4ea722818331&h.t=1574107589832&http.initiator=api&rt.start=api&rt.si=d3954bf8-8e7c-4a2a-a28d-f19a36233238&rt.ss=1574107597590&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Origin: https://www.zdnet.com

Response headers

Pragma: no-cache
Date: Mon, 18 Nov 2019 20:06:30 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Mon, 18 Nov 2019 20:06:30 GMT

POST jot
syndication.twitter.com/i/ Frame FC38 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dw.cbsi.com
URL: https://dw.cbsi.com/anonc.js

Domain: dw.cbsi.com
URL: https://dw.cbsi.com/js/cbsi/ds.js

Domain: in.ml314.com
URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=18102019

Domain: ml314.com
URL: https://ml314.com/csync.ashx?fp=ffbfc032898a81e62192406dcda21d11c00dd45a01214666bd20a03d3ad5d662f4cb09cee1a4f8eb&person_id=3606146128957407316&eid=50082

Domain: ml314.com
URL: https://ml314.com/csync.ashx?fp=d5571d7f493b9103cf44e93270984493&eid=50146&person_id=3606146128957407316

Domain: ml314.com
URL: https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2jt3BpOZqGY0F4vHtha80ne9r-zpcdAkYKaRLiUyevB0&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil

Domain: dpm.demdex.net
URL: https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3606146128957407316&redir=

Domain: lightboxapi2.azurewebsites.net
URL: https://lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1574107589895&callback=jQuery17105000643395710664_1574107589745&_=1574107589896

Domain: api.viglink.com
URL: https://api.viglink.com/api/ping

Domain: syndication.twitter.com
URL: https://syndication.twitter.com/i/jot

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

29 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service pending (GDPR consent not granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service pending (GDPR consent not granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service pending (GDPR consent not granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service pending (GDPR consent not granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 320) Message: Found registered service worker: [object ServiceWorkerRegistration]
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 767) Message: ADS: queuing nav-ad-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1239) Message: ADS: queuing intromercial-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1281) Message: ADS: queuing leader-plus-top-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service pending (GDPR consent not granted): script_twitterwidgets
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1425) Message: ADS: queuing inpage-video-top-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1435) Message: ADS: queuing sharethrough-top-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1752) Message: ADS: queuing mpu-plus-top-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1856) Message: ADS: queuing dynamic-showcase-top-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 1863) Message: ADS: queuing mpu-middle-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 2101) Message: ADS: queuing mpu-bottom-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 2118) Message: ADS: queuing leader-plus-bottom-5dd2f9be925bb for display
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: GDPR consent granted
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent finally granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent finally granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent finally granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent finally granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent finally granted): script_twitterwidgets
console-api	info	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 305) Message: Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9) Message: Missing adCookieData!
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent already granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent already granted): script_chartbeat
console-api	log	URL: https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/(Line 92) Message: Service loading (GDPR consent already granted): script_ad

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

684dd30d.akstat.io
ad.doubleclick.net
adservice.google.com
adservice.google.nl
api.viglink.com
api1.lightboxcdn.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cdn.syndication.twimg.com
cdn.viglink.com
dpm.demdex.net
dw.cbsi.com
iicbsi-a.akamaihd.net
in.ml314.com
js-sec.indexww.com
l.betrad.com
lightboxapi2.azurewebsites.net
match.adsrvr.org
ml314.com
pbs.twimg.com
ping.chartbeat.net
pixel.mathtag.com
platform.twitter.com
securepubads.g.doubleclick.net
static.chartbeat.com
syndication.twitter.com
t.co
tags.bluekai.com
tags.tiqcdn.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
www.everestjs.net
www.lightboxcdn.com
www.zdnet.com
zd.net
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
api.viglink.com
dpm.demdex.net
dw.cbsi.com
in.ml314.com
lightboxapi2.azurewebsites.net
ml314.com
syndication.twitter.com
104.244.42.5
104.244.42.8
104.96.143.46
151.101.14.133
152.199.23.241
172.217.16.162
172.217.23.134
2.18.233.143
2.18.233.201
2.20.171.216
23.67.136.71
2600:9000:21f3:b600:18:1fcd:349:ca21
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:50a5
2606:4700::6810:51a5
2606:4700::6810:a20d
2a00:1450:4001:814::2002
2a02:26f0:6c00:181::11a6
2a02:26f0:6c00::210:ba1b
2a04:4e42:1b::444
3.213.170.20
34.248.158.173
35.190.38.167
52.49.153.216
54.87.95.71
67.199.248.13
72.247.225.98
0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0
03532814821f169f4c4bc775fc12dc3e79d20d73efcb9a8d278bd8756c6e6ebf
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bca2eedd443a8b8dfe138e9c9467e6b76de7f60d69495bae8f949e689e9cbf5
0dd96e4c2618b847e44b23e56ab9ca48410e53a21d35a5dbed55526d6fdf9cd5
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10e3f0e1055b3fddce20d3709a959c956fc5fed562af715f9a419615c287cbbb
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
22f71c21eb2309397ddaece26f9c16c1b282969a63ae3dce4aee8f98ff66401e
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
364efc68e57240e144c1334b7b4e77dcac0dc65d71777b38992f6cd8ffc67b73
371678c738b3bbea36b32d7cb5b0b4d14182ee51ac165ae7ae45f6dc78c29a3d
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3a18cc29d89287ebb9fa636217661fa8879a33f91abe2ff4e730fd1065d526c7
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0
458031c1beb286b351738608cbd8513550fb9f1330a80c9b3a31ef43edde2028
490e4bfc694eb831ba439b5d5decbe1b488391681ee6424fa439683a4e4dc095
49c2a3cf0f363bf387c06a35a4a4e6c7255799b3776bed55914862136d783028
4b6d022516b48072704aeeb407e2d557568647087feefa57f1b216abcd49c171
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4dabcf86a321e132330448c63a36d88816c4f633896650bf2231e0a074d9f0d9
4dc1b4519a10e5fa6c35ea646267726e2198ecb52d0862f05aea5d30b8a9c4e2
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6d882ff14a4e92b34ee7447c70342e3fb51fcc83c58bef39834cac4d046b1f1d
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
723a9ea05d1491d99d5defcd6db01a8c9fb50b583e69889abad120b0a74a2c2a
72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76d54e3e54e9e510919a16e465341bfa77820a8e10f52b8ccb2064580b4f58c4
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7aee25147e91ea27917ac5cfd8ea30fdcae0e6b1072e51a1d644dafb76ab5c4f
7c46604c0440be3fd2d6a5e217846cde699e81422afd52625b633bc28cfe3446
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
82bbafe6f10665c303950cee83918e548ed3048f21062fd2b79d00d67a89bd01
82c188f1e0364d9c5a0b07b51e9bbdceb139d17839498d65a1384a302eeb6f9f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86385663e668c7cd9e9eefe2169e64a1e6bc68c6da5bd3932600dc058cbb8135
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
93186c254a44cae276e2c5b92fd902fb3d91a52c34d1e5b9aceab13855884401
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d552c0df8b25867ece11ae83f61fe132599d8307bac5d5ba743b2378d2cb1d
b4a3d1551c7f6d704c039c803f2cb25d93939c4e8082c5d33b3f23caf54ab2b3
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bd13404866644f19bfd9bb0d8c96f58536885414ba14fcae712da48d22e74631
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d
c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4
c50a17e8272b9359e4b62e0f305e201f359cb5bd2245671c115d031f2b7f68d0
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c81e2b59aeb1521bfab865dd23e8de784fa284a0c3ecfc1ead406e1d4d61c18d
c8a1d34850735ed9223b2b239195bd5532a75dba793bd0e3f1f4af609c81ae61
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cdd64e5652c18bfd813e4c6adfd0d2c030bcf0c4730ac94cb6371e79cfc6f7c0
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5bd32899e67fa7c88b01ccae606bc29b05993bd892756f7c097448e27b47981
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
f5b5ac5fdb8870504505be0a9522061f905e5c1b25a927f877303785129cb3f9
f8e130623183629519cd4682c962f9b9f56edf85d47c2ba9b2898583a0f9895b
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5
ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

www.zdnet.com Open in urlscan Pro 2.18.233.143 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

91 Requests

89 %HTTPS

40 %IPv6

30 Domains

41 Subdomains

28 IPs

5 Countries

1475 kBTransfer

5185 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

89 %
HTTPS

40 %
IPv6

30
Domains

41
Subdomains

28
IPs

5
Countries

1475 kB
Transfer

5185 kB
Size

0
Cookies

91 HTTP transactions
10 data transactions