URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-lat...
Submission: On November 22 via manual from US

Summary

This website contacted 58 IPs in 7 countries across 51 domains to perform 314 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 2.18.233.143 16625 (AKAMAI-AS)
81 2a04:4e42:1b:... 54113 (FASTLY)
1 2.20.171.216 16625 (AKAMAI-AS)
25 72.247.226.64 16625 (AKAMAI-AS)
1 72.247.225.98 16625 (AKAMAI-AS)
5 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 172.217.22.34 15169 (GOOGLE)
2 34.198.36.32 14618 (AMAZON-AES)
1 216.58.205.230 15169 (GOOGLE)
1 35.190.38.167 15169 (GOOGLE)
14 152.199.23.241 15133 (EDGECAST)
1 3 2a00:1450:400... 15169 (GOOGLE)
7 151.101.114.133 54113 (FASTLY)
1 2600:9000:20e... 16509 (AMAZON-02)
1 2a01:4a0:1338... 201011 (NETZBETRI...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
10 52.86.197.16 14618 (AMAZON-AES)
2 9 63.32.143.173 16509 (AMAZON-02)
5 64.30.230.22 6623 (CBSI-1)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
3 95.101.203.206 16625 (AKAMAI-AS)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 3.93.243.95 14618 (AMAZON-AES)
1 1 23.67.136.71 20940 (AKAMAI-ASN1)
2 2 35.190.72.21 15169 (GOOGLE)
2 2 2.18.233.201 16625 (AKAMAI-AS)
2 2 3.248.124.132 16509 (AMAZON-02)
3 4 54.93.117.16 16509 (AMAZON-02)
1 5 54.154.151.160 16509 (AMAZON-02)
4 99.80.15.126 16509 (AMAZON-02)
1 54.154.203.64 16509 (AMAZON-02)
1 23.99.128.52 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 35.177.212.30 16509 (AMAZON-02)
2 34.253.43.81 16509 (AMAZON-02)
6 35.181.91.36 16509 (AMAZON-02)
1 4 66.117.28.68 15224 (OMNITURE)
2 11 23.5.97.37 16625 (AKAMAI-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 104.17.208.240 13335 (CLOUDFLAR...)
1 2600:9000:204... 16509 (AMAZON-02)
1 5 54.77.205.213 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 35.227.208.151 15169 (GOOGLE)
2 2 66.117.28.86 15224 (OMNITURE)
2 2 172.217.23.130 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
1 35.157.160.140 16509 (AMAZON-02)
5 2600:9000:20e... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
6 34.224.154.10 14618 (AMAZON-AES)
1 2a00:1450:401... 15169 (GOOGLE)
3 151.101.13.194 54113 (FASTLY)
7 34.197.12.217 14618 (AMAZON-AES)
11 151.101.114.2 54113 (FASTLY)
4 151.101.113.181 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
24 151.101.14.2 54113 (FASTLY)
314 58
Apex Domain
Subdomains
Transfer
81 cbsistatic.com
zdnet3.cbsistatic.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet4.cbsistatic.com
techrepublicvideo.cbsistatic.com
12 MB
35 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
458 KB
27 moatads.com
z.moatads.com Failed
mb.moatads.com
geo.moatads.com
px.moatads.com
175 KB
14 tiqcdn.com
tags.tiqcdn.com
89 KB
12 zdnet.com
www.zdnet.com
urs.zdnet.com
302 KB
11 scorecardresearch.com
sb.scorecardresearch.com
7 KB
11 cbsi.com
dw.cbsi.com
saa.cbsi.com
12 KB
10 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
62 KB
10 ml314.com
ml314.com
in.ml314.com
17 KB
10 chartbeat.net
ping.chartbeat.net
2 KB
10 viglink.com
cdn.viglink.com
api.viglink.com
112 KB
7 omtrdc.net
cbsinteractive.hb.omtrdc.net
2 KB
7 demdex.net
dpm.demdex.net
cbsi.demdex.net
6 KB
7 cbsinteractive.com
vidtech.cbsinteractive.com
445 KB
6 litix.io
inqlnfvog763mmf771rou737u.litix.io
1 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 lightboxcdn.com
www.lightboxcdn.com
api1.lightboxcdn.com
128 KB
5 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
75 KB
4 perfectmarket.com
widget.perfectmarket.com
94 KB
4 eyeota.net
ps.eyeota.net
1 KB
4 akstat.io
686eb51b.akstat.io
5f651e6e.akstat.io
0211c844.akstat.io
1 KB
4 go-mpulse.net
c.go-mpulse.net
50 KB
3 fastly.net
cbsi-adops-fastly.global.ssl.fastly.net
206 KB
3 everestjs.net
www.everestjs.net
8 KB
3 tru.am
tru.am
beacon.tru.am
14 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 facebook.com
www.facebook.com
348 B
2 2mdn.net
s0.2mdn.net
103 KB
2 facebook.net
connect.facebook.net
112 KB
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
728 B
2 google.com
adservice.google.com
www.google.com
367 B
2 betrad.com
l.betrad.com
240 B
1 gstatic.com
csi.gstatic.com
304 B
1 googleapis.com
imasdk.googleapis.com
1 summerhamster.com
www.summerhamster.com
181 B
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 google.de
www.google.de
110 B
1 googleadservices.com
www.googleadservices.com
305 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 trackonomics.net
cdn-magiclinks.trackonomics.net
18 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
17 KB
1 azurewebsites.net
lightboxapi1.azurewebsites.net
579 B
1 adsrvr.org
match.adsrvr.org
536 B
1 bluekai.com
tags.bluekai.com
859 B
1 akamaihd.net
iicbsi-a.akamaihd.net
272 B
1 chartbeat.com
static.chartbeat.com
23 KB
1 google.nl
adservice.google.nl
171 B
1 indexww.com
js-sec.indexww.com
29 KB
1 evidon.com
c.evidon.com
511 B
314 51
Domain Requested by
24 images.taboola.com vidtech.cbsinteractive.com
cdn.taboola.com
23 techrepublicvideo.cbsistatic.com vidtech.cbsinteractive.com
23 px.moatads.com www.zdnet.com
19 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
17 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
11 sb.scorecardresearch.com 2 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
11 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
11 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
11 www.zdnet.com 1 redirects www.zdnet.com
zdnet3.cbsistatic.com
10 ping.chartbeat.net www.zdnet.com
9 ml314.com 2 redirects tags.tiqcdn.com
ml314.com
www.zdnet.com
7 trc.taboola.com cdn.taboola.com
7 cbsinteractive.hb.omtrdc.net vidtech.cbsinteractive.com
7 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
vidtech.cbsinteractive.com
6 inqlnfvog763mmf771rou737u.litix.io vidtech.cbsinteractive.com
6 saa.cbsi.com tags.tiqcdn.com
6 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
5 cdn-gl.imrworldwide.com vidtech.cbsinteractive.com
cdn-gl.imrworldwide.com
5 secure-us.imrworldwide.com 1 redirects
5 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
vidtech.cbsinteractive.com
5 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
5 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 pixel.everesttech.net 1 redirects
4 api.viglink.com cdn.viglink.com
4 ps.eyeota.net 3 redirects www.zdnet.com
4 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
3 cbsi-adops-fastly.global.ssl.fastly.net
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
2 www.google-analytics.com widget.perfectmarket.com
2 0211c844.akstat.io zdnet1.cbsistatic.com
2 www.facebook.com connect.facebook.net
2 cm.everesttech.net 2 redirects
2 s0.2mdn.net zdnet2.cbsistatic.com
s0.2mdn.net
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 cbsi.demdex.net tags.tiqcdn.com
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 l.betrad.com www.zdnet.com
2 securepubads.g.doubleclick.net www.zdnet.com
securepubads.g.doubleclick.net
2 z.moatads.com www.zdnet.com
vidtech.cbsinteractive.com
1 csi.gstatic.com s0.2mdn.net
1 imasdk.googleapis.com s0.2mdn.net
1 www.summerhamster.com
1 ad.yieldmanager.com
1 www.google.de
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 www.googleadservices.com 1 redirects
1 5f651e6e.akstat.io c.go-mpulse.net
1 cm.g.doubleclick.net 1 redirects
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 cdn-magiclinks.trackonomics.net tags.tiqcdn.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 geo.moatads.com z.moatads.com
1 mb.moatads.com z.moatads.com
1 api1.lightboxcdn.com www.lightboxcdn.com
1 lightboxapi1.azurewebsites.net www.lightboxcdn.com
1 match.adsrvr.org js-sec.indexww.com
1 tags.bluekai.com 1 redirects
1 686eb51b.akstat.io zdnet1.cbsistatic.com
1 in.ml314.com ml314.com
1 beacon.tru.am tru.am
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 static.chartbeat.com zdnet2.cbsistatic.com
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.nl securepubads.g.doubleclick.net
1 urs.zdnet.com zdnet2.cbsistatic.com
1 ad.doubleclick.net www.zdnet.com
1 js-sec.indexww.com www.zdnet.com
1 c.evidon.com www.zdnet.com
314 75
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2019-04-23 -
2020-07-22
a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA
2019-02-22 -
2021-02-26
2 years crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2019-02-01 -
2020-05-02
a year crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2019-04-25 -
2021-06-24
2 years crt.sh
*.doubleclick.net
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh
*.zdnet.com
DigiCert SHA2 High Assurance Server CA
2017-12-12 -
2020-12-15
3 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
*.google.com
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA
2018-12-13 -
2020-12-17
2 years crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
*.ml314.com
Amazon
2019-03-16 -
2020-04-16
a year crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-11-22 -
2020-05-30
6 months crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-24 -
2020-03-01
6 months crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
*.eyeota.net
Let's Encrypt Authority X3
2019-09-19 -
2019-12-18
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
viglink.com
Amazon
2019-02-09 -
2020-03-09
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
*.azurewebsites.net
Microsoft IT TLS CA 5
2019-09-24 -
2021-09-24
2 years crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2019-06-23 -
2020-09-25
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-11-06 -
2020-02-04
3 months crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.trackonomics.net
Go Daddy Secure Certificate Authority - G2
2018-12-22 -
2020-02-20
a year crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2019-02-25 -
2020-02-25
a year crt.sh
*.urbanairship.com
DigiCert ECC Secure Server CA
2018-06-20 -
2020-06-24
2 years crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
www.google.de
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2019-12-24
6 months crt.sh
*.summerhamster.com
Let's Encrypt Authority X3
2019-09-30 -
2019-12-29
3 months crt.sh
*.googleapis.com
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh
*.litix.io
Amazon
2019-01-22 -
2020-02-22
a year crt.sh
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-01-02 -
2020-01-03
a year crt.sh
*.hb.omtrdc.net
DigiCert SHA2 Secure Server CA
2017-12-22 -
2020-01-03
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-03 -
2021-02-22
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2019-11-05 -
2020-01-28
3 months crt.sh

This page contains 11 frames:

Primary Page: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Frame ID: CF56A8445406BA8C3EE7EEAAA88C1AB6
Requests: 309 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 0BF41EA0C578078239542834AA53E302
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574439345733&lv=1
Frame ID: 9EA66DDF1D6D5D90244A74D1AF4EA275
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
Frame ID: 10B929DFDAF456E9EFEA75F7435AEF4D
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 4AF1FE8DB1CE9B5808827E21A8B3DF13
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 7484B12216925E4B19B9FD50EDC62B4F
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 146F978858BF88016B1C5DA452E047C5
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Frame ID: 7DCC6008D1092D089E6EF18A20B4B0D4
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 068B671A415B6265042A28AB191D2714
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: BF34BD99A01F8D847C13D35E239E07F8
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: B0827C82A22BE9CF104337FE76F7CA81
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i


Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

314
Requests

99 %
HTTPS

36 %
IPv6

51
Domains

75
Subdomains

58
IPs

7
Countries

14553 kB
Transfer

21245 kB
Size

17
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45
  • https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d?_=1574439345645 HTTP 301
  • https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d/?_=1574439345645
Request Chain 72
  • https://tags.bluekai.com/site/20486?limit=0&id=3606235184319954949&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3606235184319954949%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=04rL1y9999YpV5C5&person_id=3606235184319954949&eid=50056
Request Chain 73
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3606235184319954949 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNjIzNTE4NDMxOTk1NDk0ORAAGg0IspPg7gUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=52eb6c3d08db342664a46af64a2cf38f3d7207b6a51aaa1b45a2d69a6e82afcff4cb09cee1a4f8eb&person_id=3606235184319954949&eid=50082
Request Chain 74
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606235184319954949%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606235184319954949%26eid=50220&mm_bnc&mm_bct&UUID=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1 HTTP 302
  • https://ml314.com/csync.ashx?fp=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1&person_id=3606235184319954949&eid=50220
Request Chain 75
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606235184319954949 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606235184319954949 HTTP 302
  • https://ml314.com/csync.ashx?fp=3feac1e2b12935198b29bf0df819e049&eid=50146&person_id=3606235184319954949
Request Chain 76
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2VrZ9C5XMD7ihwfC7Kba2w9oyIW5inxVpHf3y_YEMaEM&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
  • https://ml314.com/csync.ashx?fp=2VrZ9C5XMD7ihwfC7Kba2w9oyIW5inxVpHf3y_YEMaEM&person_id=3606235184319954949&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil HTTP 302
  • https://ps.eyeota.net/match/bounce/?bid=r8hrb20&uid=nil
Request Chain 77
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3606235184319954949&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3606235184319954949&redir=
Request Chain 102
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 120
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c9=
Request Chain 124
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&rp=&ts=compact&rnd=1574439351678 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&rp=&ts=compact&rnd=1574439351678&ja=1
Request Chain 140
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGRnSnR3QUFCY3NQeGtxNw HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEAYgR6CBDmsLWpvW9kLzVnM&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 143
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=twnYXb27MITjgQem85TgCQ&random=800582575&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651&ipr=y
Request Chain 253
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=5094&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=5094&ns_st_dpt=5094&ns_st_ipt=5094&ns_st_et=5094&ns_st_det=5094&ns_st_upc=5094&ns_st_dupc=5094&ns_st_iupc=5094&ns_st_upa=5094&ns_st_dupa=5094&ns_st_iupa=5094&ns_st_lpc=5094&ns_st_dlpc=5094&ns_st_lpa=5094&ns_st_dlpa=5094&ns_st_pa=5094&ns_ts=1574439358158&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9= HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=5094&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=5094&ns_st_dpt=5094&ns_st_ipt=5094&ns_st_et=5094&ns_st_det=5094&ns_st_upc=5094&ns_st_dupc=5094&ns_st_iupc=5094&ns_st_upa=5094&ns_st_dupa=5094&ns_st_iupa=5094&ns_st_lpc=5094&ns_st_dlpc=5094&ns_st_lpa=5094&ns_st_dlpa=5094&ns_st_pa=5094&ns_ts=1574439358158&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=

314 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/
463 KB
108 KB
Document
General
Full URL
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
048d4d3cbcdd6f4a898814bdf05afc48a024871b4b86c8436c18ca869a6da047
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
cache-control
max-age=5400, private
x-tx-id
de1a4e9a-e143-4aec-a1b3-c7d97de798c2
x-xss-protection
1; mode=block
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
expires
Fri, 22 Nov 2019 17:45:44 GMT
last-modified
Fri, 22 Nov 2019 16:15:44 GMT
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options
SAMEORIGIN
access-control-allow-origin
https://www.zdnet.com
content-encoding
gzip
accept-ranges
bytes
date
Fri, 22 Nov 2019 16:15:44 GMT
set-cookie
fly_device=desktop; expires=Fri, 29-Nov-2019 16:15:44 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "nl"}; expires=Fri, 29-Nov-2019 16:15:44 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary
Accept-Encoding, User-Agent
strict-transport-security
max-age=63072000; includeSubDomains; preload
moatheader.js
z.moatads.com/cbsprebidheader506831276743/
0
0

main-f23f75230f-rev.css
zdnet3.cbsistatic.com/fly/1864-fly/css/core/
342 KB
62 KB
Stylesheet
General
Full URL
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
800ac967629a26ef4750b85947614e3872a82d12c233c67295a2ffa6b24c3c6f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86621
status
200
strict-transport-security
max-age=31536000
content-length
63244
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:51 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5df-5572a"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:04 GMT
controls-c24fd029e9-rev.css
zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/
17 KB
4 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-c24fd029e9-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6b973e246a4ddcfc0854d5d5410183c478c186ff1f8531b2265cd94e6c057d5
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86621
status
200
strict-transport-security
max-age=31536000
content-length
3683
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:06:06 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5ee-4408"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:04 GMT
evidon-sitenotice-tag.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
69 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
398130
status
200
strict-transport-security
max-age=31536000
content-length
13960
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2019 19:35:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dcdac89-1134e"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2019 01:33:30 GMT
country.js
c.evidon.com/geo/
260 B
511 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.20.171.216 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-20-171-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
last-modified
Wed, 30 May 2018 22:22:39 GMT
server
AkamaiNetStorage
access-control-allow-origin
etag
"8d3bb7b8708f6911ebe937e111b09ec4:1527718959"
access-control-max-age
86400
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
status
200
accept-ranges
bytes
access-control-allow-headers
*
content-length
260
snthemes.js
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
94 KB
8 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
308567
status
200
strict-transport-security
max-age=31536000
content-length
7763
x-xss-protection
1; mode=block
last-modified
Mon, 18 Nov 2019 09:18:33 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd261e9-177f3"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 02:31:26 GMT
settings.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
33 KB
2 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
389698
status
200
strict-transport-security
max-age=31536000
content-length
1669
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2019 19:35:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dcdac89-828e"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2019 04:00:47 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/jpeg
en.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/
311 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
55784
status
200
strict-transport-security
max-age=31536000
content-length
14353
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:44 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5d8-4ddff"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2019 00:44:53 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/jpeg
steve-ranger.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/10/23/19c4c0fc-b89c-45a9-868e-468e6fef6571/thumbnail/40x40/2f9363b1551f579475ec3d7037d4da2c/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/10/23/19c4c0fc-b89c-45a9-868e-468e6fef6571/thumbnail/40x40/2f9363b1551f579475ec3d7037d4da2c/steve-ranger.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8009003c0031cf9a3750da3c19766334140c0c3d04500b279929d35ca2086905
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10263598
status
200
content-transfer-encoding
binary
strict-transport-security
max-age=31536000
content-length
1152
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a424ed4bd3a7d6aea720b86d4a360f75"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-why-were-still-losing-the-fig-5da5c838b93c140001b0d2b7-1-oct-18-2019-22-02-18-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/18/ff689d35-a9ff-4408-8ed5-069c89c7a79a/thumbnail/570x322/0aedcb9ae1e5881f7092dcbc51a64d78/
17 KB
17 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/18/ff689d35-a9ff-4408-8ed5-069c89c7a79a/thumbnail/570x322/0aedcb9ae1e5881f7092dcbc51a64d78/ransomware-why-were-still-losing-the-fig-5da5c838b93c140001b0d2b7-1-oct-18-2019-22-02-18-poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
54cb5314730285c5d21ce51925d43fbc6d5e513ae7b7237f822a80f07ba42f33
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
419239
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
17118
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"537442dc2f31b1311163fef609949f9c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
advertisement.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/
53 B
385 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3824
status
200
strict-transport-security
max-age=31536000
content-length
71
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd6b4f0-35"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2019 15:11:59 GMT
mag-white01.png
zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/core/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86620
status
200
strict-transport-security
max-age=31536000
content-length
936
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b4f0-4f1"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:05 GMT
ring-animated.svg
zdnet1.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/video/
704 B
459 B
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/video/ring-animated.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-c24fd029e9-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86619
status
200
strict-transport-security
max-age=31536000
content-length
364
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd6b4f0-2c0"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Nov 2020 16:12:05 GMT
Raleway-Bold.woff2
zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
51 KB
51 KB
Font
General
Full URL
https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
x-content-type-options
nosniff
age
11138932
status
200
nncoection
close
strict-transport-security
max-age=31536000
content-length
52212
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-cbf4"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
Raleway-Light.woff2
zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
x-content-type-options
nosniff
age
11138931
status
200
strict-transport-security
max-age=31536000
content-length
51608
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-c998"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
Raleway-Regular.woff2
zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
50 KB
Font
General
Full URL
https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:44 GMT
x-content-type-options
nosniff
age
2969066
status
200
strict-transport-security
max-age=31536000
content-length
51572
x-xss-protection
1; mode=block
last-modified
Thu, 17 Oct 2019 18:12:58 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da8af2a-c974"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 18 Oct 2020 07:30:18 GMT
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1864-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86620
status
200
strict-transport-security
max-age=31536000
content-length
6305
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:46 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5da-3f09"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:04 GMT
vendorlist.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
113 KB
51 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
517229
status
200
strict-transport-security
max-age=31536000
content-length
52305
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2019 19:39:36 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dcdad78-1c3b9"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2019 16:35:13 GMT
logo.png
zdnet4.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86620
status
200
strict-transport-security
max-age=31536000
content-length
4128
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b4f0-1009"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:06 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1864-fly/js/
206 KB
68 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e0621ff3644a6732ed62761fcf1d33ad53a1f9fa19c71e7e872e5244fe50793d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86619
status
200
strict-transport-security
max-age=31536000
content-length
69918
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:48 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5dc-3369a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:05 GMT
moatheader.js
z.moatads.com/cbsprebidheader506831276743/
193 KB
69 KB
Script
General
Full URL
https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ff452e92c4558e00c55b48159730622cf3f4dea7826a3247a3853e7059add887

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Nov 2019 19:08:31 GMT
Server
AmazonS3
x-amz-request-id
F665D0F42154F3C8
ETag
"86cace2433ac6f8e6464c893d3d6869e"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=20386
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
69789
x-amz-id-2
iIEFhBwBZNsFpaAHaCZBwPCIObRPZZ7yB2YS3Y1jxnqx7hXhcjRa+4bykygRP8USDA9fsiBtFBc=
ls-zdnet.js
js-sec.indexww.com/ht/
94 KB
29 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 Nov 2019 15:16:01 GMT
Server
Apache
ETag
"da2162-176c0-597f0e4452667"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=219
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
29092
Expires
Fri, 22 Nov 2019 16:19:25 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 0BF4
187 KB
47 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
br
Last-Modified
Tue, 12 Nov 2019 10:04:32 GMT
Server
Akamai Resource Optimizer
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
47928
gpt.js
securepubads.g.doubleclick.net/tag/js/
51 KB
16 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
188e42e723cc4177e5e0935d6d1631d12141fc944072dec45545f0e150f2c262
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"344 / 270 of 1000 / last-modified: 1574377050"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15642
x-xss-protection
0
expires
Fri, 22 Nov 2019 16:15:45 GMT
evidon-banner.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
8 KB
2 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
388248
status
200
strict-transport-security
max-age=31536000
content-length
2440
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2019 19:39:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dcdad76-1faf"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2019 04:19:38 GMT
18863
l.betrad.com/site/v3/425/3445/8/1/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/8/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.36.32 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-36-32.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
204
date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by
Express
vary
Accept-Encoding
;ord=1574439345184
ad.doubleclick.net/ddm/ad/vgrxsj/apvwpddqf/
43 B
205 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/ad/vgrxsj/apvwpddqf/;ord=1574439345184?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s24-in-f230.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
18863
l.betrad.com/site/v3/425/3445/8/4/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/8/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.36.32 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-36-32.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
204
date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by
Express
vary
Accept-Encoding
urs.js
urs.zdnet.com/sdk/
50 KB
50 KB
Script
General
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
scrolling-mpu-22779a851e-rev.js
zdnet3.cbsistatic.com/fly/js/components/
956 B
599 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
172473
status
200
strict-transport-security
max-age=31536000
content-length
491
x-xss-protection
1; mode=block
last-modified
Wed, 20 Nov 2019 15:40:46 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd55e7e-3bc"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Nov 2019 16:21:12 GMT
config.json
c.go-mpulse.net/api/ Frame 0BF4
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5248131&v=1.571.0&if=&sl=0&si=28ghil975hg-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
d76d014c9502788c02aa428f9b1514cb0710ec140528051ccf256431ba3a069b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
699
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
94 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DD6) /
Resource Hash
e47dab0fc8f606fffed7633ec00e128497015eda58f5b3c152c50cab502ad745

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Thu, 21 Nov 2019 20:12:52 GMT
server
ECAcc (lha/8DD6)
etag
"3559851753"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19494
expires
Fri, 22 Nov 2019 16:20:45 GMT
integrator.js
adservice.google.nl/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.nl/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019111801.js
securepubads.g.doubleclick.net/gpt/
159 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 18 Nov 2019 14:07:04 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
59620
x-xss-protection
0
expires
Fri, 22 Nov 2019 16:15:45 GMT
article-95650e82d0-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
160 KB
45 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-95650e82d0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
7ff155d8ae26056213d07aecbdce9d7857daa7c30e61acc3f31e9885c17e1d4e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
173470
status
200
strict-transport-security
max-age=31536000
content-length
45743
x-xss-protection
1; mode=block
last-modified
Wed, 20 Nov 2019 15:40:56 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd55e88-27fc9"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Nov 2019 16:04:35 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/
1 MB
281 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
age
2275948
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by
cache-dca17779-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1574439346.691858,VS0,VE0
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
F767A360D0453B01
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
506313, 2
chartbeat_video.js
static.chartbeat.com/js/
69 KB
23 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat_video.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:6600:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
92a3a79c64f777aa63d0d7ffe31e49c3fb9c15b207257071f482533864d0b43a

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:09:49 GMT
content-encoding
gzip
last-modified
Tue, 29 Oct 2019 02:09:28 GMT
server
nginx
age
355
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
nXDp4PwbUX1DZ5_6VlcvNVDCNa-7aVoLfFB3DYlrL0HtAGDGKGNXrQ==
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
expires
Fri, 22 Nov 2019 18:09:49 GMT
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
22 B
272 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a01:4a0:1338:28::c38a:ff18 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Cache-Control
max-age=242113
Server
AkamaiNetStorage
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
78 KB
28 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
cf-cache-status
HIT
age
138793
status
200
content-type
text/javascript
content-length
27746
x-amz-id-2
L1s8Yh+CMGwzqWrO24gvwL3s9QCXaLs9ZYTFAF9q0BVy9FqATw+dPLawpww8YBEYhnx1eLyb3k0=
last-modified
Mon, 21 Oct 2019 20:13:23 GMT
server
cloudflare
etag
"df893ab92782cedac4da4785df9ec68e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
90620ADCD4F2320F
cache-control
max-age=1800, must-revalidate
accept-ranges
bytes
cf-ray
539c3436894a5964-VIE
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6966
status
200
strict-transport-security
max-age=31536000
content-length
4877
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:46 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5da-2fdf"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2019 14:19:38 GMT
/
www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d/
Redirect Chain
  • https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d?_=1574439345645
  • https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d/?_=1574439345645
403 KB
96 KB
XHR
General
Full URL
https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d/?_=1574439345645
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ab00099de5e245b05e2e4c1fdc735e378b8aefe6ab88d834830dfd61e7e52b4f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com;
content-encoding
gzip
x-content-type-options
nosniff
status
404
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:15:46 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
4e8b118d-bbda-4af3-92ca-d5e3dfed84e0
content-type
text/html; charset=UTF-8
cache-control
max-age=5400, private
expires
Fri, 22 Nov 2019 17:45:46 GMT

Redirect headers

date
Fri, 22 Nov 2019 16:15:45 GMT
vary
Accept-Encoding, User-Agent
server
nginx
status
301
location
https://www.zdnet.com/ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d/?_=1574439345645
content-type
text/html
access-control-allow-origin
https://www.zdnet.com
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
178
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D1E) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECAcc (lha/8D1E)
etag
"392561602+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D27) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECAcc (lha/8D27)
etag
"3447796852"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DDB) /
Resource Hash
cdd64e5652c18bfd813e4c6adfd0d2c030bcf0c4730ac94cb6371e79cfc6f7c0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Wed, 13 Nov 2019 18:23:50 GMT
server
ECAcc (lha/8DDB)
etag
"1483923147"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48594
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
958 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D3E) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D3E)
etag
"2267415266"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D32) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D32)
etag
"3334871598"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D1A) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECAcc (lha/8D1A)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Sat, 07 Dec 2019 16:15:45 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
968 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C89) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECAcc (lha/8C89)
etag
"1907756232"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Sat, 07 Dec 2019 16:15:45 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&u=BFQykADY90wre1v8I&d=zdnet.com&g=65713&g0=security&g1=steve%20ranger&n=1&f=00001&c=0&x=0&m=0&y=3076&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=3214&t=CJxdZGYDPT_iTFbdDSiZVuz9xs8&V=118&i=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&tz=-60&_acct=anon&sn=1&sv=UxC0MB9Ok9vI1EqPYseSD5VS2H&sd=1&im=067b2ef3&_
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:45 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1574439345671&s=daa041fcc530ad0dc870beeeaef8af3ba95b2de6aac239952a9c669698ec2a3f
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
423f20ec113842e6edf242a4dc46fabb87284b44f58f4beaa1cd50798657181a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
802
tag.aspx
ml314.com/
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?22102019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 Nov 2019 23:10:23 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=24877
Connection
keep-alive
Content-Length
11932
Expires
Fri, 22 Nov 2019 23:10:23 GMT
pixel.gif
cdn.viglink.com/images/
43 B
265 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=1.921309018292787
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
cf-cache-status
HIT
age
15
status
200
content-type
image/gif
content-length
43
x-amz-id-2
t88rWQgU2/uo3QydFhLeVM3UPrx96yvsPlSn7UZADDE1P7FP7sB3n3XlMXgeB3GsMeSMsBnYJMw=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FA07682CDCAF6026
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
539c3436c97e5964-VIE
pixel.gif
cdn.viglink.com/images/
43 B
104 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=1.921309018292787
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
cf-cache-status
HIT
age
15
status
200
content-type
image/gif
content-length
43
x-amz-id-2
t88rWQgU2/uo3QydFhLeVM3UPrx96yvsPlSn7UZADDE1P7FP7sB3n3XlMXgeB3GsMeSMsBnYJMw=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FA07682CDCAF6026
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
539c3436c97f5964-VIE
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
f2e30d5b33dd74313b4b7d5cea5417a1183ca3c47b537bdc1c94976b2e6813c5

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:49 GMT
Server
Apache/2.4.25
Etag
YiZk8V3YCbXLp+ifSic.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=675
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=780
Content-Length
6423
Expires
Fri, 22 Nov 2019 16:45:49 GMT
cbsinteractive.js
tru.am/scripts/custom/
3 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
br
cf-cache-status
HIT
age
2349
status
200
x-guploader-uploadid
AEnB2UoxuVpBYbm2MU4pfF4xXZoxe5tsOmoo4vpBBiYD_zucY32TjgtpUqub_Sc5GQz3T5gCzQV-G07cd050LTmafQPHV7f4Gw
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Tue, 30 Apr 2019 19:32:26 GMT
server
cloudflare
etag
W/"c486c91d1321adf59073588524182108"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
content-type
text/javascript
x-goog-generation
1556652746634603
cache-control
public, max-age=86400
x-goog-stored-content-length
2725
cf-ray
539c34371eb95a0c-VIE
expires
Fri, 22 Nov 2019 16:36:36 GMT
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 9EA6
326 B
549 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574439345733&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
6444228e71bf757a91c98fa225e5f5ab1474ce4ab2e00f8bb4891f704961d856

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
320495
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
539c34372b628c98-VIE
st.v3.js
www.everestjs.net/static/
25 KB
7 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.203.206 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-203-206.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7effa2e2d6e22b52d6aaaa218ded825e24ab9360db646bcc394965d66c5d0ced

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Nov 2019 09:57:26 GMT
Server
Apache
ETag
"1ff0663-6344-597c43544892d"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=46551
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7255
Expires
Sat, 23 Nov 2019 05:11:41 GMT
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 9EA6
765 KB
125 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637095599000739157
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1574439345733&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82bbafe6f10665c303950cee83918e548ed3048f21062fd2b79d00d67a89bd01

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
L28yRUQu8FZzxMomJSK6sQ==
age
320494
cf-polished
origSize=1203760
status
200
x-ms-lease-status
unlocked
last-modified
Mon, 11 Nov 2019 23:10:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
138190f2-201e-00fd-5b65-9e6aa3000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
539c34379bae8c98-VIE
cf-bgj
minify
ta-pagesocial-sdk.js
tru.am/scripts/
35 KB
12 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
br
cf-cache-status
HIT
age
3026
status
200
x-guploader-uploadid
AEnB2UpxIuTyJmwigXahxCgS-G0_ZEd3gHXP64lRhwUE90x1nLSVl-tcux1xsH-gjl0nXQm9KuCrTGmuaNgNkwAolGMxY0CV6A
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Fri, 19 Apr 2019 06:14:55 GMT
server
cloudflare
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=O7AZFg==, md5=lC1a4eUSzN8YgTVQQo3QAg==
content-type
application/javascript
x-goog-generation
1555654495662585
cache-control
public, max-age=86400
x-goog-stored-content-length
35540
cf-ray
539c34379f1c5a0c-VIE
expires
Fri, 22 Nov 2019 16:25:18 GMT
beacon
beacon.tru.am/
0
0
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:46 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
539c34383a44cb9c-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637091106076939970
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637095599000739157
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 22 Nov 2019 16:15:45 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
q4B4xYJoZwx9ikt94o1nCA==
age
320492
cf-polished
origSize=6016
x-ms-meta-cbmodifiedtime
Wed, 10 Apr 2019 18:50:43 GMT
status
200
x-ms-lease-status
unlocked
last-modified
Wed, 10 Apr 2019 19:06:17 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
301ad383-b01e-00b7-41e5-985ac4000000
cache-control
max-age=31536000
x-ms-version
2009-09-19
cf-ray
539c34380c068c98-VIE
cf-bgj
minify
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 10B9
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637095599000739157
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637091106076939970
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
accept-encoding
gzip, deflate, br
cookie
__cfduid=dd18e68e121191e356aac6016a127b17b1574439345
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

status
200
date
Fri, 22 Nov 2019 16:15:46 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Mon, 11 Nov 2019 23:10:07 GMT
x-ms-request-id
ec260dfe-a01e-0009-1350-a14f4f000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cache-control
max-age=31536000
cf-cache-status
MISS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
539c34382c1b8c98-VIE
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/
35 B
257 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1574439345918&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 22 Nov 2019 16:15:45 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1847668
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
539c34382c188c98-VIE
cf-bgj
imgq:85
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&pv=1574439346078_cmj8k5vxu&bl=en-us&cb=2872600&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1574439346078_cmj8k5vxu&cid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?22102019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
de1e3453e64a32339148ad1afe4a0f7c30082d7d80c9ad60440585e678fa7030

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
522
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=22102019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?22102019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.243.95 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-93-243-95.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Sat, 23 Nov 2019 16:15:46 GMT
/
686eb51b.akstat.io/
0
354 B
XHR
General
Full URL
https://686eb51b.akstat.io/?h.pg=article&when=1574439346097&t_other=custom4%7C2316&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=61fe9ccfea0307be4a8e293c1212ff0020dd2540&h.t=1574439345747&http.initiator=api&rt.start=api&rt.si=f2cca7f1-79e8-4386-80c3-baeb5204bfa0&rt.ss=1574439348890&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:46 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Fri, 22 Nov 2019 16:15:46 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=3606235184319954949&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3606235184319954949%26eid=50056
  • https://ml314.com/csync.ashx?fp=04rL1y9999YpV5C5&person_id=3606235184319954949&eid=50056
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=04rL1y9999YpV5C5&person_id=3606235184319954949&eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:48 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Sat, 23 Nov 2019 11:15:49 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=04rL1y9999YpV5C5&person_id=3606235184319954949&eid=50056
Date
Fri, 22 Nov 2019 16:15:49 GMT
Connection
keep-alive
Content-Length
0
BK-Server
485
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3606235184319954949
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNjIzNTE4NDMxOTk1NDk0ORAAGg0IspPg7gUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=52eb6c3d08db342664a46af64a2cf38f3d7207b6a51aaa1b45a2d69a6e82afcff4cb09cee1a4f8eb&person_id=3606235184319954949&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=52eb6c3d08db342664a46af64a2cf38f3d7207b6a51aaa1b45a2d69a6e82afcff4cb09cee1a4f8eb&person_id=3606235184319954949&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:46 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Sat, 23 Nov 2019 11:15:46 GMT

Redirect headers

date
Fri, 22 Nov 2019 16:15:46 GMT
via
1.1 google
location
https://ml314.com/csync.ashx?fp=52eb6c3d08db342664a46af64a2cf38f3d7207b6a51aaa1b45a2d69a6e82afcff4cb09cee1a4f8eb&person_id=3606235184319954949&eid=50082
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
status
307
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606235184319954949%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3606235184319954949%26eid=50220&mm_bnc&mm_bct&UUID=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1
  • https://ml314.com/csync.ashx?fp=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1&person_id=3606235184319954949&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1&person_id=3606235184319954949&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Sat, 23 Nov 2019 11:15:46 GMT

Redirect headers

Date
Fri, 22 Nov 2019 16:15:46 GMT
Server
MT3 1913 979072d master zrh-pixel-x20
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=dbf45dd8-086e-4300-b2d3-79ec6d3cf8b1&person_id=3606235184319954949&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Fri, 22 Nov 2019 16:15:45 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606235184319954949
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3606235184319954949
  • https://ml314.com/csync.ashx?fp=3feac1e2b12935198b29bf0df819e049&eid=50146&person_id=3606235184319954949
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=3feac1e2b12935198b29bf0df819e049&eid=50146&person_id=3606235184319954949
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:45 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Sat, 23 Nov 2019 11:15:46 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:46 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=3feac1e2b12935198b29bf0df819e049&eid=50146&person_id=3606235184319954949
Cache-Control
no-cache
X-Server
10.45.27.183
Connection
keep-alive
Content-Length
0
Expires
0
/
ps.eyeota.net/match/bounce/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2VrZ9C5XMD7ihwfC7Kba2w9oyIW5inxVpHf3y_YEMaEM&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
  • https://ml314.com/csync.ashx?fp=2VrZ9C5XMD7ihwfC7Kba2w9oyIW5inxVpHf3y_YEMaEM&person_id=3606235184319954949&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
  • https://ps.eyeota.net/match/bounce/?bid=r8hrb20&uid=nil
70 B
171 B
Image
General
Full URL
https://ps.eyeota.net/match/bounce/?bid=r8hrb20&uid=nil
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.93.117.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-93-117-16.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:49 GMT
Content-Length
70
Content-Type
image/gif

Redirect headers

Location
/match/bounce/?bid=r8hrb20&uid=nil
Date
Fri, 22 Nov 2019 16:15:49 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3606235184319954949&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3606235184319954949&redir=
42 B
873 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3606235184319954949&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v054-0bd6d4674.edge-irl1.demdex.com 5.63.0.20191112162344 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
8M9sdYO7TQQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
nZNqzd3wT1Y=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3606235184319954949&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ping
api.viglink.com/api/
266 B
946 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
bf213a61ac726a18807397bddef7b619adbf149b9538b0cca22ed448d4e85848

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
266
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rid
match.adsrvr.org/track/
109 B
536 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.203.64 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-203-64.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7d4379db396416fce4c84eb2f30294e0d5836f24d011328a1c1ec2296cbbbfb7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Fri, 22 Nov 2019 16:15:46 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Sun, 22 Dec 2019 16:15:46 GMT
z
lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/
341 B
579 B
Script
General
Full URL
https://lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1574439346812&callback=jQuery17109466020999926208_1574439345911&_=1574439346813
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637095599000739157
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e11ef4f4ac089cf20af14da114f59b6a70567f42bea530db1a59d95d9c04a9b3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:50 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Content-Length
366
Vary
Accept-Encoding
Content-Type
application/javascript
z.gif
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkEA2AJToAggAc5UegHV6AIwDSEIkgDMAdmS7xWDQAkAKsAAyAGnRQIAa3roA4vVxOQ0gMLkAJxAAW3p4fQAONCMATlQRZBj9dA5Y...
182 B
547 B
XHR
General
Full URL
https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkEA2AJToAggAc5UegHV6AIwDSEIkgDMAdmS7xWDQAkAKsAAyAGnRQIAa3roA4vVxOQ0gMLkAJxAAW3p4fQAONCMATlQRZBj9dA5YADNYAIg9Q2MgA___XZX/z.gif
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637095599000739157
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
50489555526e4d24f0e44c58d75a251cecbb74dfd8445a09d2bac66f3b08f9db

Request headers

Accept
*/*
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:46 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
71506
status
200
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
cf-ray
539c343ddda4cbc4-VIE
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
6095abbb05678ad2420d05f73b4e99041c20411c08afa86511a69a7f4bdb0412

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
yi.js
mb.moatads.com/
2 KB
2 KB
Script
General
Full URL
https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&callback=MoatNadoAllJsonpRequest_19296439
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.212.30 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-212-30.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
882b89e91f4bf03dbbc9df96a58cc00f24eb3c5262953e7ed86436485fa3e296

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:49 GMT
server
TornadoServer/4.5.3
etag
"8d8a2be79fc48c910f0246ed6fe1bcb1c3f16d5a"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
2131
n.js
geo.moatads.com/
100 B
274 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1574439349502&de=904183172440&rx=954790181751&m=0&ar=86f84746398-clean&iw=cd40877&q=1&cb=0&cu=1574439349502&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&fs=174403&na=91810348&cs=0&callback=MoatDataJsonpRequest_19296439
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.212.30 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-212-30.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
77e6604b757d3c83419e9b62b6403d57f10c1237d29ec187745e511ae8715ab2

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:49 GMT
server
TornadoServer/4.5.3
etag
"7ca51320f1e53f1df590b70d6463b88fe5d1c49b"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
100
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&t=1574439349502&de=539560488380&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=86f84746398-clean&iw=cd40877&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&ac=1&bq=11&f=0&na=1208979974&cs=0
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:49 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1574439349550
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
9e90ab774d8cf2fc4bd0a9683a51df9cdd2fdc9532da65d05731b13c68628b87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v054-0f83a8d76.edge-irl1.demdex.com 5.63.0.20191112162344 5ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
ZihcvaW5QWQ=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
690
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
139 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201911212012&cb=1574439349551
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DA7) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:49 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (lha/8DA7)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Fri, 22 Nov 2019 16:25:49 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 4AF1
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.253.43.81 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-253-43-81.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
gzip, deflate, br
Cookie
demdex=00978766688924010673329663983030683979
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 14 Nov 2019 14:06:03 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=00978766688924010673329663983030683979;Path=/;Domain=.demdex.net;Expires=Wed, 20-May-2020 16:15:49 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
SMWEfYbsSew=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/
90 B
624 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=00754888887602075713342477076251741235&ts=1574439349595
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a48d7d86d6a12c3821418fd734d5fcc2e4c4c55454af88b9011afb26beb59ccf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Fri, 22 Nov 2019 16:15:49 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-5fc496b8d4-mg5rn
vary
Origin
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript
content-length
90
x-xss-protection
1; mode=block
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&t=1574439349502&de=539560488380&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=86f84746398-clean&iw=cd40877&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&ac=1&bq=11&f=0&zn=0&na=912187751&cs=0
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:49 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=62369aaf-e86b-4001-867b-aca2cb3b822f&assettitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&assettype=content_article&pubdate=2019-11-21%2012%3A44%3A00&viewguid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&devicetype=desktop&sitetype=responsive%20web&author=steve%20ranger&authorid=5cae6838-8176-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1574439349655&ld=www.zdnet.com&ldc=b6850c4d-3f58-41f6-b56c-a61b43eb5962&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=YiZk8V3YCbXLp%2BifSic&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&title=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=655
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=44&t=1574439349502&de=539560488380&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=86f84746398-clean&iw=cd40877&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=181&zMoatAllDataLoadTime=181&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&ac=1&bq=11&f=0&zn=1&if=181&na=1879571820&cs=0
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:49 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=00754888887602075713342477076251741235&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=AVID%012EEC04DA85159303-6000085526D27B7A&ts=1574439349687
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
96970fdca8565f34daeea301d8dd4358593100f3857f69b43d563768d0ef6918
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v054-0a1c13cad.edge-irl1.demdex.com 5.63.0.20191112162344 5ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
ZNZaiCx6QvU=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
691
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s11636399899722
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s11636399899722?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=22%2F10%2F2019%2017%3A15%3A49%205%20-60&d.&nsid=0&jsonv=1&.d&mid=00754888887602075713342477076251741235&aid=2EEC04DA85159303-6000085526D27B7A&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&cc=USD&ch=editorial&server=www.zdnet.com&v0=ftag%3ATRE-03-10aaa6b&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=wordpress&c2=D%3Dv2&l2=113c25b6-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=5cae6838-8176-11e2-9d12-0018fe8a00b0&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=62369aaf-e86b-4001-867b-aca2cb3b822f&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=YiZk8V3YCbXLp%2BifSic&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
306c04f0d3d3fb9dad6bf09a45209b064a6a89a310a34ad331125e396df8e040
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-aam-tid
deSNvnfKTHs=
date
Fri, 22 Nov 2019 16:15:49 GMT
x-content-type-options
nosniff
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
status
200
content-length
1674
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-v054-03c4a9c89.edge-irl1.demdex.com 5.63.0.20191112162344 6ms (+1ms)
pragma
no-cache
last-modified
Sat, 23 Nov 2019 16:15:49 GMT
server
jag
xserver
anedge-5fc496b8d4-g9jmz
etag
3381082756830560256-4619755963054025338
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 21 Nov 2019 16:15:49 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
cf-cache-status
HIT
age
138799
status
200
content-type
text/javascript
content-length
27746
x-amz-id-2
L1s8Yh+CMGwzqWrO24gvwL3s9QCXaLs9ZYTFAF9q0BVy9FqATw+dPLawpww8YBEYhnx1eLyb3k0=
last-modified
Mon, 21 Oct 2019 20:13:23 GMT
server
cloudflare
etag
"df893ab92782cedac4da4785df9ec68e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
90620ADCD4F2320F
cache-control
max-age=1800, must-revalidate
accept-ranges
bytes
cf-ray
539c345b79f35964-VIE
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201911212012
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D39) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECAcc (lha/8D39)
etag
"1112944691"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Sat, 07 Dec 2019 16:15:51 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
953 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201911212012
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C8C) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8C8C)
etag
"461771432+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Sat, 07 Dec 2019 16:15:51 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201911212012
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C8B) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8C8B)
etag
"4198895974+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Sat, 07 Dec 2019 16:15:51 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201911212012
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DB7) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECAcc (lha/8DB7)
etag
"931235332"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Sat, 07 Dec 2019 16:15:51 GMT
utag.1810.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201911212012
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D07) /
Resource Hash
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
last-modified
Mon, 08 Jul 2019 17:22:10 GMT
server
ECAcc (lha/8D07)
etag
"4274102907+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
988
expires
Sat, 07 Dec 2019 16:15:51 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 7484
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.253.43.81 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-253-43-81.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
gzip, deflate, br
Cookie
demdex=00978766688924010673329663983030683979; dextp=269-1-1574439349763|477-1-1574439349865|771-1-1574439349966|22052-1-1574439350067|30646-1-1574439350169|121998-1-1574439350270|70027-1-1574439350371
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 14 Nov 2019 14:38:39 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=00978766688924010673329663983030683979;Path=/;Domain=.demdex.net;Expires=Wed, 20-May-2020 16:15:51 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
+f7CQoKwR2Q=
Content-Length
2764
Connection
keep-alive
pixel_details.html
www.everestjs.net/static/ Frame 146F
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.203.206 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-203-206.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=19892
Expires
Fri, 22 Nov 2019 21:47:23 GMT
Date
Fri, 22 Nov 2019 16:15:51 GMT
Content-Length
146
Connection
keep-alive

Redirect headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Server
Apache
Set-Cookie
everest_session_v2=XdgJtwAABcsPxkq7; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XdgJtwAABcsPxkq7; path=/; domain=.everesttech.net; expires=Sun, 17-Oct-2021 02:55:51 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XdgJtwAABcsPxkq7&gsurfer=XdgJtwAABcsPxkq7&optout=0&throttleCookie=&time=20191122161551
Content-Length
345
Keep-Alive
timeout=15, max=999676
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
496e9f805fa2717597682be4551ebce8248658538c9e65809e12398c15f59261
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
528
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 22 Nov 2019 15:54:21 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:15:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
a3121502-1c8d-4c67-a2fd-87ef3136edfb
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Fri, 22 Nov 2019 17:24:21 GMT
disqus-loader-c0f4996196-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
743 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-c0f4996196-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
46b1556bbc2c6aa113e0c1528889851f259cd58a8ccbd1adee36b0d7d86b7f4e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
173475
status
200
strict-transport-security
max-age=31536000
content-length
634
x-xss-protection
1; mode=block
last-modified
Wed, 20 Nov 2019 15:40:46 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd55e7e-574"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Nov 2019 16:04:36 GMT
webjpg.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/70x53/6106c9ce72119cf599174914f1f87b60/
2 KB
2 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/70x53/6106c9ce72119cf599174914f1f87b60/webjpg.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
86b94334465d020bf78104b9ec74702c4df513a0c2c82c0a26a2726b529fe829
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
9588
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1681
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f50a6c02a3fc5a3a5d4d9391f05f3efc"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-paying-the-hackers-only-makes-5d81f19602a77a0001ab908b-1-sep-18-2019-14-09-33-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/18/ce9eb83c-7bc7-43dd-ba63-ee5866483160/thumbnail/70x53/303108ecf4b9fd435cdec50f8ff4b2b1/
1 KB
2 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/18/ce9eb83c-7bc7-43dd-ba63-ee5866483160/thumbnail/70x53/303108ecf4b9fd435cdec50f8ff4b2b1/ransomware-paying-the-hackers-only-makes-5d81f19602a77a0001ab908b-1-sep-18-2019-14-09-33-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2970ff12e0c4ec8f24948ece12776e77ea682a61b8eeaf699a428bf8c57d5d2b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
92821
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1298
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a51fb975227d6640e4fe47854476d133"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
softwaredevelopersistock-670517478.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/11/20/9f7582b5-bffd-49f5-a0c4-8dda8a7740fa/thumbnail/70x53/b163fcb4e422c7ff436a51d02c3512bc/
5 KB
5 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/11/20/9f7582b5-bffd-49f5-a0c4-8dda8a7740fa/thumbnail/70x53/b163fcb4e422c7ff436a51d02c3512bc/softwaredevelopersistock-670517478.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5495fb3589c8d83e90b4ba27cf43e5455479896dcec56e3fdd8e9180b8809c9d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
186223
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
4641
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"3dde889723e33ace6af907cd5cc8e187"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-11-steps-to-help-keep-hackers-5d8343209fad230001c552a3-1-sep-20-2019-11-43-24-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/20/8c4e9da0-8c0d-49bf-af2f-0602dad1be3a/thumbnail/70x53/8aefb416d435c10105306cfc9f021be9/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/20/8c4e9da0-8c0d-49bf-af2f-0602dad1be3a/thumbnail/70x53/8aefb416d435c10105306cfc9f021be9/ransomware-11-steps-to-help-keep-hackers-5d8343209fad230001c552a3-1-sep-20-2019-11-43-24-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
79e1dad0d09d72b636ac0610386cc3dbdcb2e7e0fa4435438fa2299d06737f3e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
186958
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1205
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"c4851e8e264415c4094e4e85b0baa7cc"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5f094c07888854207f5bcd1fa7b58f95f90006cbaa6c0255ff035396a4542eb0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
757
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:15:52 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
58a6c190-fb1d-454e-a5c0-836493781b98
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 22 Nov 2019 16:15:52 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6969
status
200
strict-transport-security
max-age=31536000
content-length
1564
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b5d3-124a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2019 14:19:42 GMT
patchguard.png
zdnet4.cbsistatic.com/hub/i/r/2019/11/22/e4a6dd89-8dee-4874-8281-f1c5020d2060/thumbnail/170x128/3b56743fa5f23e7b35e3f8702064bca0/
24 KB
24 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/11/22/e4a6dd89-8dee-4874-8281-f1c5020d2060/thumbnail/170x128/3b56743fa5f23e7b35e3f8702064bca0/patchguard.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b9f302a2bc6a98a540d1ae773ad95aa0a6e0da1cd8bb630a1ab628cbcf37d587
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
24748
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"f15422af60aef6cd7e46f10b21b23d8c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
webjpg.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/170x128/b4010abf392024f6f89ce05dc862b8c6/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/170x128/b4010abf392024f6f89ce05dc862b8c6/webjpg.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66fa83d355349ddf9398181109120dc4a3e04edc67ccb80ef1fb7e1289e1722a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
9596
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
5348
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b32e8760418e68f23c811a1cfd6bda78"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
irs-scandal-ludicrous-claims-about-missing-government-emails-been-there-done-that.jpg
zdnet3.cbsistatic.com/hub/i/r/2014/08/18/52a4eba3-26bb-11e4-8c7f-00505685119a/thumbnail/170x128/bc1980f9f4944b1d0c0eccf0a76919f6/
10 KB
11 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2014/08/18/52a4eba3-26bb-11e4-8c7f-00505685119a/thumbnail/170x128/bc1980f9f4944b1d0c0eccf0a76919f6/irs-scandal-ludicrous-claims-about-missing-government-emails-been-there-done-that.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0960af040ddb11b51e449dca7ab1a7dc21116127b0800c3a00147f719d30ceb7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
32644
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
10693
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a8fbbd3b11424ce032ba813493d95ad7"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
optus-yes.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/10/c5c534b2-caff-4a50-baee-d935b659b195/thumbnail/170x128/06caf2c604e9e88a8ed6a85c0fa96ae0/
7 KB
7 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/10/c5c534b2-caff-4a50-baee-d935b659b195/thumbnail/170x128/06caf2c604e9e88a8ed6a85c0fa96ae0/optus-yes.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c00d20ad50f9db6e623712551f7487ffb66a9657fd900625b015c03a6b7b5781
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
665119
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
7160
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"456048afb7253926e1fbb7486e699180"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
t-mobile-ceo-john-legere-jump-2013-med.png
zdnet3.cbsistatic.com/hub/i/r/2016/08/18/388461af-6891-412b-8293-6b93e4ef0874/thumbnail/170x128/a45ec5eb04edcc96861830ba6434f69b/
44 KB
44 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2016/08/18/388461af-6891-412b-8293-6b93e4ef0874/thumbnail/170x128/a45ec5eb04edcc96861830ba6434f69b/t-mobile-ceo-john-legere-jump-2013-med.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3be3ee8c5293f578f8865ed6e5e7dc65fcb83260ed177fc05bede39605c5c317
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
348189
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
45067
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"320bb3786195303bf2d99e662cc832fa"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
976 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
244963
status
200
strict-transport-security
max-age=31536000
content-length
827
x-xss-protection
1; mode=block
last-modified
Tue, 19 Nov 2019 16:08:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd4136c-514"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 20:13:07 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
120 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
197598
status
200
strict-transport-security
max-age=31536000
content-length
0
x-xss-protection
1; mode=block
last-modified
Tue, 19 Nov 2019 16:08:28 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd4137c-0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Nov 2019 09:22:31 GMT
comscore.streaming.6.1.1.171219.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/
104 KB
19 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
age
1226177
x-cache
HIT, HIT
status
200
content-length
18881
x-amz-id-2
neN7zmXGABIZIsD8sbebZF9DlZwNnRoW8FayLQeAr6iI61AA4xefpinkv4fSD61J73FNfhwdnmU=
x-served-by
cache-dca17772-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:21:03 GMT
server
AmazonS3
x-timer
S1574439352.682340,VS0,VE0
etag
"c3c30c0ebfc35a9426296256fc3133d8"
vary
Accept-Encoding
x-amz-request-id
2141EBE8710B207D
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
173, 5
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201911212012
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Mon, 25 Nov 2019 16:15:51 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20clic...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:51 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1574439351672&ns_c=UTF-8&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c9=
Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:51 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
121 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
f20f83cb7683a1a3138cd52201d83436e33a5e67ef0b9c96bbdab860b5f7da16
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';report-uri https://www.facebook.com/csp/reporting/
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-23=":443"; ma=3600
content-length
26765
x-xss-protection
0
pragma
public
x-fb-debug
4YkP1Taime5AyGWkDPz0VUlov01e/umWX70nEJyZ/xygnecfolw0pHVusHDjv/hIPkeLu46baI66Jd4X65DjBg==
x-fb-trip-id
420120009
date
Fri, 22 Nov 2019 16:15:51 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';report-uri https://www.facebook.com/csp/reporting/
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
70 KB
17 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201911212012
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
a86c13ba9ecf99da51d6d85da54b38a98ec9d7aaef44f4d0cabeca0d5e7076d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
129648
cf-polished
origSize=72933
status
200
edge-control
max-age=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"11ce5-6FYo5LgsZ9kafVkpzZRkijdYFBk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=60, s-maxage=604800
cf-ray
539c345c4e36bdf5-AMS
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cbs_zQTp2H_zdnet.js
cdn-magiclinks.trackonomics.net/client/static/v2/
95 KB
18 KB
Script
General
Full URL
https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201911212012
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2043:2a00:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 01:31:56 GMT
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 06:53:39 GMT
server
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age
53035
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
x-amz-cf-pop
FRA54
access-control-allow-origin
*
x-amz-cf-id
qGP6HeaUlHHFn6Kmr1PU9lthnDYIAjKG9Ef-c_1nq8hUJxfgSfKKIQ==
via
1.1 07318a09275049862b4535d73a930b7d.cloudfront.net (CloudFront)
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&rp=&ts=compact&rnd=1574439351678&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.205.213 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-205-213.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:51 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:51 GMT
server
nginx
access-control-allow-origin
*
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&rp=&ts=compact&rnd=1574439351678&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
302
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
webjpg.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/70x53/6106c9ce72119cf599174914f1f87b60/
2 KB
2 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/70x53/6106c9ce72119cf599174914f1f87b60/webjpg.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
86b94334465d020bf78104b9ec74702c4df513a0c2c82c0a26a2726b529fe829
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
9588
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1681
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f50a6c02a3fc5a3a5d4d9391f05f3efc"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
softwaredevelopersistock-670517478.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/11/20/9f7582b5-bffd-49f5-a0c4-8dda8a7740fa/thumbnail/70x53/b163fcb4e422c7ff436a51d02c3512bc/
5 KB
5 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/11/20/9f7582b5-bffd-49f5-a0c4-8dda8a7740fa/thumbnail/70x53/b163fcb4e422c7ff436a51d02c3512bc/softwaredevelopersistock-670517478.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5495fb3589c8d83e90b4ba27cf43e5455479896dcec56e3fdd8e9180b8809c9d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
186223
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
4641
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"3dde889723e33ace6af907cd5cc8e187"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ima3.js
s0.2mdn.net/instream/html5/
273 KB
93 KB
Script
General
Full URL
https://s0.2mdn.net/instream/html5/ima3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0ec3a9908b9659e6153920a69b6f8c50d3e37ad7bac5f171f02e7b6af20b100a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
94888
x-xss-protection
0
expires
Fri, 22 Nov 2019 16:15:51 GMT
feature-disabled-d41d8cd98f-rev.js
zdnet3.cbsistatic.com/fly/js/
0
102 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/feature-disabled-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
252300
status
200
strict-transport-security
max-age=31536000
content-length
0
x-xss-protection
1; mode=block
last-modified
Tue, 19 Nov 2019 16:08:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd4136c-0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 18:10:51 GMT
ransomware-11-steps-to-help-keep-hackers-5d8343209fad230001c552a3-1-sep-20-2019-11-43-24-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/20/8c4e9da0-8c0d-49bf-af2f-0602dad1be3a/thumbnail/70x53/8aefb416d435c10105306cfc9f021be9/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/20/8c4e9da0-8c0d-49bf-af2f-0602dad1be3a/thumbnail/70x53/8aefb416d435c10105306cfc9f021be9/ransomware-11-steps-to-help-keep-hackers-5d8343209fad230001c552a3-1-sep-20-2019-11-43-24-poster.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
79e1dad0d09d72b636ac0610386cc3dbdcb2e7e0fa4435438fa2299d06737f3e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
186958
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1205
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"c4851e8e264415c4094e4e85b0baa7cc"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-paying-the-hackers-only-makes-5d81f19602a77a0001ab908b-1-sep-18-2019-14-09-33-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/18/ce9eb83c-7bc7-43dd-ba63-ee5866483160/thumbnail/70x53/303108ecf4b9fd435cdec50f8ff4b2b1/
1 KB
1 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/18/ce9eb83c-7bc7-43dd-ba63-ee5866483160/thumbnail/70x53/303108ecf4b9fd435cdec50f8ff4b2b1/ransomware-paying-the-hackers-only-makes-5d81f19602a77a0001ab908b-1-sep-18-2019-14-09-33-poster.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2970ff12e0c4ec8f24948ece12776e77ea682a61b8eeaf699a428bf8c57d5d2b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
92821
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
1298
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a51fb975227d6640e4fe47854476d133"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
webjpg.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/170x128/b4010abf392024f6f89ce05dc862b8c6/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/11/22/38f129eb-6a72-46dc-92d4-65a0165ee0e4/thumbnail/170x128/b4010abf392024f6f89ce05dc862b8c6/webjpg.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66fa83d355349ddf9398181109120dc4a3e04edc67ccb80ef1fb7e1289e1722a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
9596
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
5348
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b32e8760418e68f23c811a1cfd6bda78"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
optus-yes.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/10/c5c534b2-caff-4a50-baee-d935b659b195/thumbnail/170x128/06caf2c604e9e88a8ed6a85c0fa96ae0/
7 KB
7 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/10/c5c534b2-caff-4a50-baee-d935b659b195/thumbnail/170x128/06caf2c604e9e88a8ed6a85c0fa96ae0/optus-yes.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c00d20ad50f9db6e623712551f7487ffb66a9657fd900625b015c03a6b7b5781
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
665119
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
7160
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"456048afb7253926e1fbb7486e699180"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
irs-scandal-ludicrous-claims-about-missing-government-emails-been-there-done-that.jpg
zdnet3.cbsistatic.com/hub/i/r/2014/08/18/52a4eba3-26bb-11e4-8c7f-00505685119a/thumbnail/170x128/bc1980f9f4944b1d0c0eccf0a76919f6/
10 KB
11 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2014/08/18/52a4eba3-26bb-11e4-8c7f-00505685119a/thumbnail/170x128/bc1980f9f4944b1d0c0eccf0a76919f6/irs-scandal-ludicrous-claims-about-missing-government-emails-been-there-done-that.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0960af040ddb11b51e449dca7ab1a7dc21116127b0800c3a00147f719d30ceb7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
age
32644
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
10693
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a8fbbd3b11424ce032ba813493d95ad7"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
t-mobile-ceo-john-legere-jump-2013-med.png
zdnet3.cbsistatic.com/hub/i/r/2016/08/18/388461af-6891-412b-8293-6b93e4ef0874/thumbnail/170x128/a45ec5eb04edcc96861830ba6434f69b/
44 KB
44 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2016/08/18/388461af-6891-412b-8293-6b93e4ef0874/thumbnail/170x128/a45ec5eb04edcc96861830ba6434f69b/t-mobile-ceo-john-legere-jump-2013-med.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3be3ee8c5293f578f8865ed6e5e7dc65fcb83260ed177fc05bede39605c5c317
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
348189
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
45067
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"320bb3786195303bf2d99e662cc832fa"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
151.208.227.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:12:00 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1556302399
age
231
status
200
x-guploader-uploadid
AEnB2UovWuySEi_wmgCcFP1MHqM_1amiRIDxmNarImyDQb_0eY6Y7nIOWsypTK59XpenRhs0NIQKB5-zy9xIrD2ghTYRIZ2WCQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16960
last-modified
Fri, 26 Apr 2019 18:13:21 GMT
server
UploadServer
etag
"251defdc0ecc8a3bad8ae4cf9aab1923"
vary
Accept-Encoding
x-goog-hash
crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation
1556302401249893
cache-control
public, max-age=300
x-goog-stored-content-length
16960
accept-ranges
bytes
content-type
application/javascript
expires
Fri, 22 Nov 2019 16:17:00 GMT
show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/
2 KB
979 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
108475
status
200
strict-transport-security
max-age=31536000
content-length
710
x-xss-protection
1; mode=block
last-modified
Wed, 20 Nov 2019 17:04:32 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd57220-7a5"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 10:07:56 GMT
309391486091569
connect.facebook.net/signals/config/
349 KB
85 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.9.13&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
1bd7a7078987d4a536bdb4a5b56faf5099813c2e4ecc8d91cee8c6526ec2f66e
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-23=":443"; ma=3600
content-length
87094
x-xss-protection
0
pragma
public
x-fb-debug
IYLrM2KqgszH1Qk3wJ6fx2mLmy934TGrb5hCbhCn627VYIE8xPciWgYgTCLqFjjLKYD783slzmuM5cU63o6dXg==
x-fb-trip-id
420120009
date
Fri, 22 Nov 2019 16:15:51 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
4083-12969.js
www.everestjs.net/dl/4083/
484 B
664 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.203.206 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-203-206.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=78768
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Sat, 23 Nov 2019 14:08:39 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Last-Modified
Thu, 28 Mar 2019 09:07:56 GMT
Server
Apache
ETag
"44366b-80-58523e3d09300"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=994572
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGRnSnR3QUFCY3NQeGtxNw
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEAYgR6CBDmsLWpvW9kLzVnM&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Last-Modified
Thu, 28 Mar 2019 09:07:56 GMT
Server
Apache
ETag
"44366b-80-58523e3d09300"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=994562
Content-Length
128

Redirect headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
/
5f651e6e.akstat.io/
0
354 B
Other
General
Full URL
https://5f651e6e.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:51 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Fri, 22 Nov 2019 16:15:51 GMT
/
www.facebook.com/tr/
44 B
268 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&rl=&if=false&ts=1574439351758&sw=1600&sh=1200&v=2.9.13&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1574439351758.743718144&it=1574439351705&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-23=":443"; ma=3600
content-length
44
expires
Fri, 22 Nov 2019 16:15:51 GMT
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=twnYXb27MITjgQ...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651&ipr=y
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=800582575&crd=&is_vtc=1&random=378205651&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
341 B
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::a000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Last-Modified
Thu, 28 Mar 2019 09:07:56 GMT
Server
Apache
ETag
"1433b3-80-58523e3d09300"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=999665
Content-Length
128
VideoHeartbeat-2.0.2.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
143 KB
29 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
age
227043
x-cache
HIT, HIT
status
200
content-length
28977
x-amz-id-2
+2U9dXma+eMS0pCyjOsjSQxM2XeIVTtFChnnV0tNV/KxKbDrO0L+Wu3OXPxKg3U2iN4g4fPtx3Y=
x-served-by
cache-dca17740-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1574439352.814486,VS0,VE0
etag
"215943f0e77b4fcc9cc72b98a8ea1cfc"
vary
Accept-Encoding
x-amz-request-id
B56B3145A1D646B8
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
162, 25
bcn
www.summerhamster.com/
43 B
181 B
Image
General
Full URL
https://www.summerhamster.com/bcn?fe=1574439351807&y=2.0.1105&elg=686988930&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fwklv-idnh-vriwzduh-xsgdwh-wulhv-wr-grzqordg-pdozduh-rqwr-brxu-sf-hyhq-zkhq-brx-folfn-odwhu%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fyjuavm%2Fdsyzsggti%2F%3Brug%3D1574439345184%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.160.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-157-160-140.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
date
Fri, 22 Nov 2019 16:15:51 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1574439351822&s=7fc19ef048e56617e930316c52c545376b853623ef9471967f75bc681eceb70e
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
c1b70915d4a91c9e458bdc788e6e645492fab55d1a6c11ff72b3653457561441

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Date
Fri, 22 Nov 2019 16:15:51 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
807
AppMeasurement-2.3.0.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
77 KB
27 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
age
1436383
x-cache
HIT, HIT
status
200
content-length
27260
x-amz-id-2
kLgdw2sQfzW8EBCh5gIdAjguNFSLxkDKLDKkIhVUuGHzfy43GfeyKZQFej1nTwA00aYX5B/mtiI=
x-served-by
cache-dca17775-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1574439352.848527,VS0,VE0
etag
"d71ba6c9a930b6864408830c3e2705f9"
vary
Accept-Encoding
x-amz-request-id
C7320C852C9DB622
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
16, 25
ggcmb510.js
cdn-gl.imrworldwide.com/novms/js/2/
12 KB
5 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:f800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
fME2wGs2EhCmDy4srgP3dWRyF.9sMrKr
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 18:51:45 GMT
server
AmazonS3
age
5053
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Fri, 22 Nov 2019 15:25:22 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
RoFTBOw6xy6QkLsz2kAX68oIkSFcjIugCSRVqb0O7_81jFGPfdMHBA==
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
mux.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/
81 KB
25 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
content-encoding
gzip
age
2444313
x-cache
HIT, HIT
status
200
content-length
25193
x-amz-id-2
uyqq9GTCYIovpBDCLE78+pIdisUuOvn8uUDB+xH4SeB2+mR2SCdeoeIES21yRqXAa2GJK5TF/V8=
x-served-by
cache-dca17758-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:21:06 GMT
server
AmazonS3
x-timer
S1574439352.898747,VS0,VE0
etag
"5d69e0e991739e9cd3f544944c8b3739"
vary
Accept-Encoding
x-amz-request-id
661201C46759821C
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 25
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/png
uvp_blank.mp4
vidtech.cbsinteractive.com/h5/blanks/
11 KB
11 KB
Media
General
Full URL
https://vidtech.cbsinteractive.com/h5/blanks/uvp_blank.mp4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 22 Nov 2019 16:15:51 GMT
via
1.1 varnish, 1.1 varnish
age
466546
x-cache
HIT, HIT
status
206
x-cache-hits
558763, 20409
Content-Length
11247
x-amz-id-2
RWSuYoveoPlVL8+CKVrvoJOxvT/jZR2ccK055Pg68MOkg2YkaejHy+1cH72KSfRTxtYrLSmSGpM=
x-served-by
cache-dca17731-DCA, cache-hhn4042-HHN
Content-Range
bytes 0-11246/11247
last-modified
Fri, 21 Dec 2018 00:54:05 GMT
server
AmazonS3
x-timer
S1574439352.950649,VS0,VE0
etag
"707bb2a4c9141aba1068d851f5be0409"
x-amz-request-id
4F6B1AEF2D270DCA
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
video/mp4
x-amz-meta-mtime
1296432000
patchguard.png
zdnet4.cbsistatic.com/hub/i/r/2019/11/22/e4a6dd89-8dee-4874-8281-f1c5020d2060/thumbnail/170x128/3b56743fa5f23e7b35e3f8702064bca0/
24 KB
24 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/11/22/e4a6dd89-8dee-4874-8281-f1c5020d2060/thumbnail/170x128/3b56743fa5f23e7b35e3f8702064bca0/patchguard.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b9f302a2bc6a98a540d1ae773ad95aa0a6e0da1cd8bb630a1ab628cbcf37d587
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
24748
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"f15422af60aef6cd7e46f10b21b23d8c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
glcfg510.js
cdn-gl.imrworldwide.com/novms/js/2/configs/
2 KB
1 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:f800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
js8iVXhZc56wE.OFtiVCSC6a8fIPaWAh
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 18:51:45 GMT
server
AmazonS3
age
4748
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Fri, 22 Nov 2019 15:19:13 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
Y0B9v63uyMSpAqjmYBGej7d1OVwRv-a3yOKTQMd80D7h3NGRAfd8bA==
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
id
dpm.demdex.net/
2 KB
2 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=00754888887602075713342477076251741235&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=AVID%012EEC04DA85159303-6000085526D27B7A&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1574439351984
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2615b1899dd8b771c641ecd424c2500c8c5ac44bc805e2c6a2f25ff200aa7ef0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v054-063418a85.edge-irl1.demdex.com 5.63.0.20191112162344 6ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-Error
300,300
X-TID
mCk4nWSJSjM=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
691
Expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Origin
https://www.zdnet.com

Response headers

Content-Type
application/font-woff;charset=utf-8
36A8CE_2_0.woff2
vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/
53 KB
54 KB
Font
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/36A8CE_2_0.woff2
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
via
1.1 varnish, 1.1 varnish
age
312871
x-cache
HIT, HIT
status
200
content-length
54767
x-amz-id-2
MB4kz71c4pCgKqmbxlPCRwopnXgRkM+K6PNPBZydd9jschWqEK3QWyQXFkKNxNrVPNecOxrwKKc=
x-served-by
cache-dca17720-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1574439352.070233,VS0,VE0
etag
"22d779c809ed11e380d62c76e1f202e8"
access-control-max-age
3600
x-amz-request-id
3ADB3AE2E6D210C6
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
157, 16
bridge3.353.0_en.html
imasdk.googleapis.com/js/core/ Frame 7DCC
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.353.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
196419
date
Fri, 22 Nov 2019 15:28:56 GMT
expires
Sat, 21 Nov 2020 15:28:56 GMT
last-modified
Wed, 20 Nov 2019 19:30:13 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2816
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Fri, 22 Nov 2019 16:15:52 GMT
/
www.zdnet.com/video/related-videos-xhr/ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late/
42 KB
6 KB
XHR
General
Full URL
https://www.zdnet.com/video/related-videos-xhr/ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4f9f5996c1ae662b5df931d220f6348ff600f89d54577167d140bf42bb7440c5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
5721
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 22 Nov 2019 15:45:31 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:15:52 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
80e5f53a-1ee7-4256-b9a6-bc483db3ebd2
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Fri, 22 Nov 2019 17:15:31 GMT
ransomware-why-were-still-losing-the-fig-5da5c838b93c140001b0d2b7-1-oct-18-2019-22-02-18-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/18/ff689d35-a9ff-4408-8ed5-069c89c7a79a/thumbnail/570x322/0aedcb9ae1e5881f7092dcbc51a64d78/
17 KB
17 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/18/ff689d35-a9ff-4408-8ed5-069c89c7a79a/thumbnail/570x322/0aedcb9ae1e5881f7092dcbc51a64d78/ransomware-why-were-still-losing-the-fig-5da5c838b93c140001b0d2b7-1-oct-18-2019-22-02-18-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
54cb5314730285c5d21ce51925d43fbc6d5e513ae7b7237f822a80f07ba42f33
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
419246
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
17118
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"537442dc2f31b1311163fef609949f9c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&r=&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0&W=0&R=0&I=1&E=0&j=75&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:52 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
cdn-gl.imrworldwide.com/conf/
41 KB
8 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:f800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
87f7ab766f2ca84cf0ab3320e468a9ba39a466fe2cbcb6454b0c76fd36ec4c0b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
UlkrvEWYHZjgGgqq2bLV4l6UGDJhzk0D
content-encoding
gzip
last-modified
Wed, 20 Nov 2019 17:25:11 GMT
server
AmazonS3
age
572
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400,s-maxage=86400
date
Fri, 22 Nov 2019 16:06:21 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
Cibf1TLOcIzIPv77hxg28g0l2MvillaesYk7GdfcSwCkaS3Xiiexyw==
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/
161 KB
46 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:f800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
787b34ffd7cd823938ab8b1f40b6651327291f1b00540438e3b291d6882ee360

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
5yAHfyBhJD41Gnp1gxvdfKWeXSGPzbrP
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 18:51:46 GMT
server
AmazonS3
age
5373
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Fri, 22 Nov 2019 15:26:57 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
sfAzfznbqza_tWAt9H4oODAYubdNkDnnqVxxN4FlAZJI1JYsxJL_8Q==
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 068B
0
0
Document
General
Full URL
https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:f800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
cdn-gl.imrworldwide.com
:scheme
https
:path
/novms/html/ls.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
accept-encoding
gzip, deflate, br
cookie
IMRID=34003d1b-80e5-413e-b77d-1636fc317e26
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

status
200
content-type
text/html
last-modified
Wed, 16 Oct 2019 18:51:45 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
wCzVpLni3BPzgPgrA6.6mKdJzB_YUVf5
server
AmazonS3
content-encoding
gzip
date
Fri, 22 Nov 2019 15:34:15 GMT
cache-control
max-age=86400
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
Ybjev033g7G__2apo9iZDdjfpdDluhkjno3KBc7KXoiOrKVMkLt3gA==
age
4570
carousel-f3b9253e16-rev.js
zdnet2.cbsistatic.com/fly/js/components/
312 B
361 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/carousel-f3b9253e16-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3818
status
200
strict-transport-security
max-age=31536000
content-length
215
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:05:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd6b5d3-138"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2019 15:12:13 GMT
/
www.facebook.com/tr/
0
80 B
Other
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryU9knVtps96A1PHkz

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
access-control-allow-origin
https://www.zdnet.com
date
Fri, 22 Nov 2019 16:15:52 GMT
content-type
text/plain
status
200
access-control-allow-credentials
true
alt-svc
h3-23=":443"; ma=3600
content-length
0
carousel-1.0.js
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/
21 KB
4 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/carousel-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
329048
status
200
strict-transport-security
max-age=31536000
content-length
4361
x-xss-protection
1; mode=block
last-modified
Mon, 18 Nov 2019 09:20:08 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd26248-5590"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2019 20:50:37 GMT
/
0211c844.akstat.io/
0
354 B
XHR
General
Full URL
https://0211c844.akstat.io/?h.pg=article&when=1574439352913&cdim.Site_View=desktop&t_other=custom3%7C860&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=778ab0058a549dfe117d95e1b82945e85b1f3cd9&h.t=1574439351838&http.initiator=api&rt.start=api&rt.si=3eda77bc-f064-4a1c-ac41-4627c0d5c16a&rt.ss=1574439355041&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:52 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Fri, 22 Nov 2019 16:15:52 GMT
/
inqlnfvog763mmf771rou737u.litix.io/
0
247 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://www.zdnet.com
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:15:53 GMT
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
POST, GET
csi
csi.gstatic.com/
0
304 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k3acjeul&c=4995119208487&slotId=2497559604243.5&eee=missing-element&bi=missing-id
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:401b:804::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:52 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
204
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
OAS_Countdown_2019_5_360.webm
cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/
40 KB
0
Media
General
Full URL
https://cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/OAS_Countdown_2019_5_360.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Range
bytes=0-

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Via
1.1 varnish
X-CDN
Fastly
Age
2896
X-Cache
HIT
Content-Range
bytes 0-235406/235407
Connection
keep-alive
Content-Length
235407
x-amz-id-2
XqxBZpC9l4Obh7SPu+X5AKmPY/+v/X3xvpJ3KrVIaQ9JzML9Oh22rqH1POaDdwgOpfbNhQTVKo8=
X-Served-By
cache-fra19166-FRA
Last-Modified
Fri, 25 Oct 2019 15:39:08 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1572017331/ctime:1572017335/gid:9078/gname:httpd/md5:7bad212be440c62203d464a0522c35d0/mode:33204/mtime:1572017333/uid:9078/uname:httpd
X-Timer
S1574439353.000788,VS0,VE9
ETag
"7bad212be440c62203d464a0522c35d0"
x-amz-request-id
2D6BF6C3502E2457
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-CDN
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes, bytes
Content-Type
video/webm
X-Cache-Hits
0
OAS_Countdown_2019_5_360.webm
cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/
6 KB
7 KB
Media
General
Full URL
https://cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/OAS_Countdown_2019_5_360.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d5eac736c81e1cec5dc26a4a10f45c1e17a5bf4918455845d8602e50f7ae4c2b

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Range
bytes=229376-

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Via
1.1 varnish
X-CDN
Fastly
Age
2896
X-Cache
HIT
Content-Range
bytes 229376-235406/235407
Connection
keep-alive
Content-Length
6031
x-amz-id-2
XqxBZpC9l4Obh7SPu+X5AKmPY/+v/X3xvpJ3KrVIaQ9JzML9Oh22rqH1POaDdwgOpfbNhQTVKo8=
X-Served-By
cache-fra19183-FRA
Last-Modified
Fri, 25 Oct 2019 15:39:08 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1572017331/ctime:1572017335/gid:9078/gname:httpd/md5:7bad212be440c62203d464a0522c35d0/mode:33204/mtime:1572017333/uid:9078/uname:httpd
X-Timer
S1574439353.106994,VS0,VE5
ETag
"7bad212be440c62203d464a0522c35d0"
x-amz-request-id
2D6BF6C3502E2457
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-CDN
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes, bytes
Content-Type
video/webm
X-Cache-Hits
0
moatvideo.js
z.moatads.com/cbsiimajsint708425247896/
284 KB
95 KB
Script
General
Full URL
https://z.moatads.com/cbsiimajsint708425247896/moatvideo.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
38432e170d5af203d75d3ac9b044adc593b6d95e53bb56c13e9976ca8437726f

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Content-Encoding
gzip
Last-Modified
Mon, 21 Oct 2019 19:09:54 GMT
Server
AmazonS3
x-amz-request-id
FB1165AAF4117AF2
ETag
"2ea6f9c51042435981771d1ccaa5b602"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=19531
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
96636
x-amz-id-2
+xc0WAJhD7uApnziDptvRt8Ui4eSNH2axQj4r6BEkjnEQvwJEcOtLzpZ+cUmzReikc47Rjm3Dq8=
10d31225525ff5790a490d4d-adobeorg.xml
cbsinteractive.hb.omtrdc.net/settings/
228 B
624 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1574439353073
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Date
Fri, 22 Nov 2019 16:23:14 GMT
Last-Modified
Fri, 15 Nov 2019 08:57:02 GMT
Server
nginx
ETag
"5dce685e-e4"
Access-Control-Allow-Methods
OPTIONS,GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Location
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type
Content-Length
228
/
www.zdnet.com/m3d0s1/xhr/right-rail/
11 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9632fcdf5570ef406de1fc11643c3eed93eadec5527de6a11caf7eb0374a7828
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1611
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:15:53 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
28bfa385-9c26-4c69-a3cf-67830b53600b
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 22 Nov 2019 16:15:53 GMT
p
sb.scorecardresearch.com/
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=5000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1574439353064&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=992&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
s11621553128538
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/
43 B
228 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s11621553128538?AQB=1&ndh=1&pf=1&t=22%2F10%2F2019%2017%3A15%3A53%205%20-60&mid=00754888887602075713342477076251741235&aid=2EEC04DA85159303-6000085526D27B7A&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c.&siteSection=editorial&siteType=responsive%20web&articleId=62369aaf-e86b-4001-867b-aca2cb3b822f&articleType=content_article&articleTitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&pageType=article&pageViewGuid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&videoAuthor=zdnet%20editors&Network=zdnet&tl=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&a.&contentType=vod&media.&name=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&friendlyName=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&length=57&playerName=UVPJS_0.42.297&view=true&vsid=1574439353075526044566&.media&.a&.c&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
x-content-type-options
nosniff
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 23 Nov 2019 16:15:53 GMT
server
jag
xserver
anedge-5fc496b8d4-t8ffk
etag
3381082765420494848-4619573918717715989
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 21 Nov 2019 16:15:53 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ad&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0.02&W=0&R=0&I=1&E=1&j=20&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:53 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&u=BFQykADY90wre1v8I&d=zdnet.com&g=65713&g0=security&g1=steve%20ranger&n=1&f=00001&c=0.12&x=0&m=0&y=3129&o=1585&w=1200&j=30&R=1&W=0&I=0&E=6&e=6&r=&b=3214&t=CJxdZGYDPT_iTFbdDSiZVuz9xs8&V=118&tz=-60&_acct=anon&_vi=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&_vp=https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/master.m3u8&_vdd=video%40zdnet.com&_vs=s1&_vt=ad&_vtn=null&_vd=57000&sn=2&sv=UxC0MB9Ok9vI1EqPYseSD5VS2H&sd=1&im=067b2ef3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:53 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
85 KB
19 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2a040554837616de71221c4ddd1197009025959fbffe573cbc9ecc1ecd70d8f0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
ApKV_IrTDHi8gHMK3IcEp2csDCKhZ32t
content-encoding
gzip
age
105
x-cache
HIT
status
200
date
Fri, 22 Nov 2019 16:15:53 GMT
content-length
18898
x-amz-id-2
Ob2McUQfb0gGT3FzFt9GMvnOmcreAXDrDLKvnckTveq3tsJxEvORkGYn3TDcYXWG+dxivuntua8=
x-served-by
cache-hhn4041-HHN
last-modified
Wed, 20 Nov 2019 11:27:36 GMT
server
AmazonS3
x-timer
S1574439353.160688,VS0,VE1
etag
"765c74e65ab1090e4540b38753679ecc"
vary
Accept-Encoding
x-amz-request-id
36B06788D94D555B
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
25
x-cache-hits
1
/
0211c844.akstat.io/
0
354 B
XHR
General
Full URL
https://0211c844.akstat.io/?h.pg=article&when=1574439353087&cdim.Site_View=desktop&t_other=custom2%7C10637&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=778ab0058a549dfe117d95e1b82945e85b1f3cd9&h.t=1574439351838&http.initiator=api&rt.start=api&rt.si=3eda77bc-f064-4a1c-ac41-4627c0d5c16a&rt.ss=1574439355041&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Fri, 22 Nov 2019 16:15:53 GMT
s12207847530662
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/
43 B
140 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s12207847530662?AQB=1&ndh=1&pf=1&t=22%2F10%2F2019%2017%3A15%3A53%205%20-60&mid=00754888887602075713342477076251741235&aid=2EEC04DA85159303-6000085526D27B7A&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c.&a.&media.&vsid=1574439353075526044566&name=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&playerName=UVPJS_0.42.297&friendlyName=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&length=57&ad.&name=4574368938&friendlyName=OAS_Countdown_2019_5&podFriendlyName=OAS_Countdown_2019_5&length=5&playerName=UVPJS_0.42.297&pod=ead9b3358912cd43a67e1991faf78f39_1&podPosition=1&podSecond=0.0&view=true&.ad&.media&contentType=vod&.a&siteSection=editorial&siteType=responsive%20web&articleId=62369aaf-e86b-4001-867b-aca2cb3b822f&articleType=content_article&articleTitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&pageType=article&pageViewGuid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&videoAuthor=zdnet%20editors&Network=zdnet&tl=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&.c&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&pe=msa_s&pev3=videoAd&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:52 GMT
x-content-type-options
nosniff
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 23 Nov 2019 16:15:53 GMT
server
jag
xserver
anedge-5fc496b8d4-tdthw
etag
3381082765420494848-4613452335116731777
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 21 Nov 2019 16:15:53 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSIMAJSINT1&hp=1&wf=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1574439353128&de=511633095450&m=0&ar=56c7b56-clean&iw=b98ba10&q=4&cb=0&ym=0&cu=1574439353128&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=%3A%3A4574368938%3A138292011654&zMoatPT=article&zMoatTest=zdnet&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&fd=1&ac=1&it=500&ti=0&ih=1&fs=173077&na=762659763&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:53 GMT
OAS_Countdown_2019_5_360.webm
cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/
198 KB
199 KB
Media
General
Full URL
https://cbsi-adops-fastly.global.ssl.fastly.net/transcoded/Q4/OAS_Countdown_2019_5_360.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1b4e880562089e962c186e8a6c4ed9342a519174d497e8cc1f2a556ea9971d1d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Range
bytes=32768-

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Via
1.1 varnish
X-CDN
Fastly
Age
2897
X-Cache
HIT
Content-Range
bytes 32768-235406/235407
Connection
keep-alive
Content-Length
202639
x-amz-id-2
XqxBZpC9l4Obh7SPu+X5AKmPY/+v/X3xvpJ3KrVIaQ9JzML9Oh22rqH1POaDdwgOpfbNhQTVKo8=
X-Served-By
cache-fra19183-FRA
Last-Modified
Fri, 25 Oct 2019 15:39:08 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1572017331/ctime:1572017335/gid:9078/gname:httpd/md5:7bad212be440c62203d464a0522c35d0/mode:33204/mtime:1572017333/uid:9078/uname:httpd
X-Timer
S1574439353.170648,VS0,VE1
ETag
"7bad212be440c62203d464a0522c35d0"
x-amz-request-id
2D6BF6C3502E2457
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-CDN
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes, bytes
Content-Type
video/webm
X-Cache-Hits
0
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&bq=8&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=24&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3129&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=4&an=0&gf=4&gg=0&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=4&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=7&cd=0&ah=7&am=0&dq=7&dr=0&ds=7&dt=0&zp=0&zx=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=982689306&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:53 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Sat, 23 Nov 2019 16:15:53 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
age
100
x-cache
HIT, HIT
status
200
date
Fri, 22 Nov 2019 16:15:53 GMT
content-length
4742
x-amz-id-2
1jqkvAwKGmiermzG1mZjxqbZmj8sgHTZaPenIiovmln8ZwZvCcLz3GGbM797Ox5pB1R97lBFxAI=
x-served-by
cache-lax8631-LAX, cache-hhn4054-HHN
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1574439353.253095,VS0,VE147
etag
"fc0de48a0976cde02ddee0bd49a81832"
vary
Accept-Encoding,,
x-amz-request-id
B89AA525DE91B839
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
x-cache-hits
1, 1
impl.20191120-8-RELEASE.js
cdn.taboola.com/libtrc/
418 KB
118 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a993ec522b27fc341edfb94cf3093c78da5349e9d846bd512ff277fc3d33ec18

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
yhIUICYJXi6WXqQhuICiYv8Z5gkaXH2d
content-encoding
gzip
age
94
x-cache
HIT
status
200
date
Fri, 22 Nov 2019 16:15:53 GMT
x-amz-replication-status
COMPLETED
content-length
120190
x-amz-id-2
wLYjjWx4ywx1NlaVLl0NR+UKagOhN9J9ILO2jcdm7M0QhAcbEVTt6BTZrLEYqQxa23GiWhjejyI=
x-served-by
cache-hhn4041-HHN
last-modified
Wed, 20 Nov 2019 10:36:35 GMT
server
AmazonS3
x-timer
S1574439353.205291,VS0,VE0
etag
"c90b891692a862fc8a6ba52ec43b2a66"
vary
Accept-Encoding
x-amz-request-id
CF924C91603C4CC8
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
0
x-cache-hits
651
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=29&q=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&bq=8&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=27&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3129&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=4&an=4&gf=4&gg=4&ez=1&aj=1&pg=100&pf=100&ib=0&cc=0&bw=4&bx=4&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=7&cd=7&ah=7&am=7&dq=7&dr=7&ds=7&dt=7&zp=0&zx=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ef=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1220681872&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:53 GMT
b
sb.scorecardresearch.com/
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1574439353227&ns_c=UTF-8&cv=3.1e&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
/
inqlnfvog763mmf771rou737u.litix.io/
0
172 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/json

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:15:53 GMT
Connection
keep-alive
Content-Length
0
Access-Control-Allow-Methods
POST, GET
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
age
9802922
x-cache
HIT, HIT
status
200
date
Fri, 22 Nov 2019 16:15:53 GMT
content-length
91236
x-amz-id-2
T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by
cache-lax8632-LAX, cache-hhn4054-HHN
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1574439353.430600,VS0,VE0
etag
"da73fb2066df9f51d08b6688cfb35441"
vary
Accept-Encoding,,
x-amz-request-id
58FF20717A687DE4
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
x-cache-hits
1694, 1316
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6136
date
Fri, 22 Nov 2019 14:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Fri, 22 Nov 2019 16:33:37 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:15:53 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Sat, 23 Nov 2019 16:15:53 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame BF34
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Fri, 22 Nov 2019 16:15:53 GMT
via
1.1 varnish
x-served-by
cache-hhn4054-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1574439354.529115,VS0,VE0
content-length
0
collect
www.google-analytics.com/r/
35 B
101 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1720326019&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&ul=en-us&de=UTF-8&dt=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=1840844323&gjid=760994636&cid=888913832.1574439354&tid=UA-33613588-22&_gid=275038304.1574439354&_r=1&cd2=other&z=783398178
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:53 GMT
content-encoding
gzip
cf-cache-status
HIT
age
138801
status
200
content-type
text/javascript
content-length
27746
x-amz-id-2
L1s8Yh+CMGwzqWrO24gvwL3s9QCXaLs9ZYTFAF9q0BVy9FqATw+dPLawpww8YBEYhnx1eLyb3k0=
last-modified
Mon, 21 Oct 2019 20:13:23 GMT
server
cloudflare
etag
"df893ab92782cedac4da4785df9ec68e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
90620ADCD4F2320F
cache-control
max-age=1800, must-revalidate
accept-ranges
bytes
cf-ray
539c3467ea875964-VIE
0.9813372534023818
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
163 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.9813372534023818?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=this+fake+software+update+tries+to+download+malware+onto+your+pc+even+when+you+click+%27later%27&v22=content_article&v23=&v24=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&v30=62369aaf-e86b-4001-867b-aca2cb3b822f&v60=33161585,32922315,2952261&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201911220-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:53 GMT
x-content-type-options
nosniff
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 23 Nov 2019 16:15:53 GMT
server
jag
xserver
anedge-5fc496b8d4-n7nxw
etag
3381082765420494848-4619016087828422350
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 21 Nov 2019 16:15:53 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=62369aaf-e86b-4001-867b-aca2cb3b822f&assettitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&assettype=content_article&pubdate=2019-11-21%2012%3A44%3A00&viewguid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&devicetype=desktop&sitetype=responsive%20web&author=steve%20ranger&authorid=5cae6838-8176-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=62369aaf-e86b-4001-867b-aca2cb3b822f&v16=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1574439353579&tcset=utf8&im=dsjs&title=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=544
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=start&l:event:duration=1&l:event:playhead=0&l:event:ts=1574439353080&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=62369aaf-e86b-4001-867b-aca2cb3b822f&s:meta:articleType=content_article&s:meta:articleTitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&s:meta:pageType=article&s:meta:pageViewGuid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:23:14 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=start&l:event:duration=0&l:event:playhead=0&l:event:ts=1574439353083&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:asset:ad_id=4574368938&s:asset:ad_sid=1574439353082697287417&s:asset:resolver=UVPJS_0.42.297&s:asset:pod_id=ead9b3358912cd43a67e1991faf78f39_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_2019_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_2019_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=62369aaf-e86b-4001-867b-aca2cb3b822f&s:meta:articleType=content_article&s:meta:articleTitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&s:meta:pageType=article&s:meta:pageViewGuid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:23:15 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1574439353094&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:22:58 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=aa_ad_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1574439353095&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:asset:ad_id=4574368938&s:asset:ad_sid=1574439353082697287417&s:asset:resolver=UVPJS_0.42.297&s:asset:pod_id=ead9b3358912cd43a67e1991faf78f39_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_2019_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_2019_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:17:06 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
domains
api.viglink.com/api/
42 B
487 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
070f3261d7c1c0f61a6a170ba38c87006e629430eb465db16a06c596a67d78b8

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:53 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame B082
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Fri, 22 Nov 2019 16:15:53 GMT
via
1.1 varnish
x-served-by
cache-hhn4054-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1574439354.760646,VS0,VE0
content-length
0
m
secure-us.imrworldwide.com/cgi-bin/
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15744393522333440&c30=bldv,6.0.0.440&c6=vc,c01&c3=st,a&cg=ZDNet%20Video&tl=dav0-We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&pr=iag.epi,We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.brn,us-700144&pr=iag.ap,pre&pr=iag.cte,&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.pod,1_1_1_1&pr=iag.apt,na&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1574439354&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1574439354&rnd=714468
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.205.213 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-205-213.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:54 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=1029&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3129&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1017&an=4&gi=1&gf=1017&gg=4&ez=1&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1017&bx=4&jz=800&dj=1&dx=1&aa=0&ad=919&cn=0&gk=919&gl=0&cq=1&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=800&cd=7&ah=800&am=7&dq=800&dr=7&ds=800&dt=7&zp=0&zx=0&vm=1&vl=0&vt=234&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&ef=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1143316038&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:54 GMT
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
12 KB
5 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=17%3A15%3A54.274&lti=deflated&data=%7B%22id%22%3A366%2C%22ii%22%3A%22%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1574439354271%2C%22cv%22%3A%2220191120-8-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A3149%2C%22qs%22%3A%22%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A2719.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
33a8ae689f5522941bcac56a1fd10c19face4ebde701654152aad7ce81f33554

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-vcl-time-ms
119
date
Fri, 22 Nov 2019 16:15:54 GMT
content-encoding
gzip
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
via
1.1 varnish
x-served-by
cache-hhn4041-HHN
server
nginx
x-timer
S1574439354.289275,VS0,VE119
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
userx.20191120-8-RELEASE.es6.js
cdn.taboola.com/libtrc/
22 KB
8 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20191120-8-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
80b14da032f9ce90efcd405e250cf828e376d8a0ad59f307f601ed28c9c27cd5

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
cYg1XAVXwj8zE.VWRPSN1GV9OPfiPPNr
content-encoding
gzip
age
75
x-cache
HIT
status
200
date
Fri, 22 Nov 2019 16:15:54 GMT
x-amz-replication-status
COMPLETED
content-length
7711
x-amz-id-2
s/EKy5LHqLm+SKbYyoNHJfnoUf1wlPo2ghgujcOsqxA1ZxGXaort7ix1WX+BifBUIYsgNaP5VY8=
x-served-by
cache-hhn4041-HHN
last-modified
Wed, 20 Nov 2019 10:36:44 GMT
server
AmazonS3
x-timer
S1574439354.448318,VS0,VE0
etag
"88b167d4d06410bcac1ea9a2704be0fa"
vary
Accept-Encoding
x-amz-request-id
6EE35E326F0342E1
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
0
x-cache-hits
187
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
176 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=9992fb3b5f35bff510913420a6fb4f8b&sd=v2_946340bb36a724130b049e8a8f646c36_a42dbcd9-9e04-4df5-8a4f-879ee54d75ac-tuct4d18f3a_1574439354_1574439354_CNawjgYQzro_GJ__l5_pLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&wi=-5201982657722330770&pt=text&vi=1574439354271&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=17%3A15%3A54.445&id=5814&llvl=1&cv=20191120-8-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4041-HHN
pragma
no-cache
server
nginx
x-timer
S1574439354.460993,VS0,VE9
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
350 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=9992fb3b5f35bff510913420a6fb4f8b&sd=v2_946340bb36a724130b049e8a8f646c36_a42dbcd9-9e04-4df5-8a4f-879ee54d75ac-tuct4d18f3a_1574439354_1574439354_CNawjgYQzro_GJ__l5_pLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&wi=-5201982657722330770&pt=text&vi=1574439354271&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A259%2C%22ly%22%3A453%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=17%3A15%3A54.445&id=1615&llvl=1&cv=20191120-8-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4041-HHN
pragma
no-cache
server
nginx
x-timer
S1574439354.461232,VS0,VE9
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
205 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=9992fb3b5f35bff510913420a6fb4f8b&sd=v2_946340bb36a724130b049e8a8f646c36_a42dbcd9-9e04-4df5-8a4f-879ee54d75ac-tuct4d18f3a_1574439354_1574439354_CNawjgYQzro_GJ__l5_pLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later&wi=-5201982657722330770&pt=text&vi=1574439354271&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A361%2C%22ly%22%3A453%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=17%3A15%3A54.445&id=8955&llvl=1&cv=20191120-8-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-vcl-time-ms
8
date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4041-HHN
pragma
no-cache
server
nginx
x-timer
S1574439354.461218,VS0,VE8
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=1030&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3129&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1017&an=1017&gi=1&gf=1017&gg=1017&ez=1&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1017&bx=1017&jz=800&dj=1&dx=1&aa=0&ad=919&cn=919&gk=919&gl=919&cq=1&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=800&cd=800&ah=800&am=800&dq=800&dr=800&ds=800&dt=800&zp=0&zx=0&vm=1&vl=234&vt=234&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&ef=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1451485970&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:54 GMT
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
162 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
9
date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4041-HHN
pragma
no-cache
server
nginx
x-timer
S1574439354.464205,VS0,VE9
content-type
image/gif
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
56acb1dab722e71a9a72959c85fe6e86.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4368488f6f4897efe452dbd12a1ceeb2f961ec34163c83bde62eb241df4b68c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
1447024
edge-cache-tag
368666536539687455465222014851182150635,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 06 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
content-length
5996
x-served-by
cache-fra19125-FRA, cache-fra19123-FRA
last-modified
Tue, 05 Nov 2019 12:54:17 GMT
server
cloudinary
x-timer
S1574439355.518608,VS0,VE1
etag
"d9d1d4081868afeb327dbb2502480785"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
006.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/006.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5773316fb5438402e1b069fafb7354b62db9eb931ce609e60075f7c80335bf02

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
555030
edge-cache-tag
586334527345271717769465656547011928953,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 17 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/006.jpg
content-length
9587
x-served-by
cache-fra19170-FRA, cache-fra19123-FRA
last-modified
Sat, 16 Nov 2019 00:57:03 GMT
server
cloudinary
x-timer
S1574439355.518803,VS0,VE1
etag
"6e6768b718b190e66dc60d74eeddc727"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/
15 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5598b49a11a77e2ea02ce80db835ddb9efe7e700264c8a84baa7f01718b44601

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
727983
edge-cache-tag
390516205635749988062413872770256542902,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 18 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
content-length
15341
x-served-by
cache-fra19142-FRA, cache-fra19123-FRA
last-modified
Fri, 18 Oct 2019 07:37:32 GMT
server
cloudinary
x-timer
S1574439355.518798,VS0,VE0
etag
"894bc95894d015f744616075fe104056"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
c9dd5322c16640ed60fa1a1742aae09c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f74bb59fc5aa63497609a7fdba4089c48a5828a2779620a6a660e6c7a66d6d19

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2540294
edge-cache-tag
351582715293950596603723956480953487256,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
content-length
9517
x-served-by
cache-fra19162-FRA, cache-fra19123-FRA
last-modified
Mon, 07 Oct 2019 18:16:16 GMT
server
cloudinary
x-timer
S1574439355.518792,VS0,VE1
etag
"b0afaa265b55b4f81b54c9cb598ed717"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
ea54e69a63fd41598401962fcba9e157.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/
28 KB
28 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/ea54e69a63fd41598401962fcba9e157.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
b31c01ae5495438ed2c074d17fe43a7271cdd769896d3a68a801873cc0a50e0d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2090305
edge-cache-tag
470464637142994121872837456985244652427,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 28 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/ea54e69a63fd41598401962fcba9e157.jpeg
content-length
28206
x-served-by
cache-fra19166-FRA, cache-fra19123-FRA
last-modified
Mon, 28 Oct 2019 19:01:59 GMT
server
cloudinary
x-timer
S1574439355.518936,VS0,VE1
etag
"aae1d8469717f2911c08614546d100fa"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
4bfc362538b0c9c31abe0b36f5269d4c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4bfc362538b0c9c31abe0b36f5269d4c.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
cc9ddbbc322aaedc11e73f45376ce3b5829f6e88c94e2a7ec8894a46fc5ef7ca

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2306986
edge-cache-tag
381570778640079623947420830258379876702,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4bfc362538b0c9c31abe0b36f5269d4c.jpg
content-length
7271
x-served-by
cache-fra19145-FRA, cache-fra19123-FRA
last-modified
Thu, 26 Sep 2019 03:02:44 GMT
server
cloudinary
x-timer
S1574439355.518936,VS0,VE1
etag
"0bd77171b2963bd49f2fd15435fe9aeb"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
0859fcb542b50369f7f538b40c10f069.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
12 KB
12 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0859fcb542b50369f7f538b40c10f069.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
58ba62d48b5bfb066e6eb1b745e54943de881794c08cf1512f6743fe6fba1e04

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
444415
edge-cache-tag
491894769881044283164617345348233772719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 03 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0859fcb542b50369f7f538b40c10f069.jpg
content-length
12342
x-served-by
cache-fra19146-FRA, cache-fra19123-FRA
last-modified
Sat, 02 Nov 2019 18:53:32 GMT
server
cloudinary
x-timer
S1574439355.521275,VS0,VE1
etag
"dc30edacc81eda27c4e02f78a496bf75"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
a6bb3db7e3af27a58a60980cc8fff65f.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
9 KB
9 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/a6bb3db7e3af27a58a60980cc8fff65f.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f04010c10191abc17120b2224c754666f8e946a500a22bc20c73aebe141259da

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
3681188
edge-cache-tag
618472640262312258893341822006573859338,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 10 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/a6bb3db7e3af27a58a60980cc8fff65f.jpg
content-length
8939
x-served-by
cache-fra19173-FRA, cache-fra19123-FRA
last-modified
Thu, 10 Oct 2019 08:13:18 GMT
server
cloudinary
x-timer
S1574439355.521263,VS0,VE1
etag
"af20c8126940b4c810208b06f2bba0c9"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
738 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
age
2829
x-cache
HIT
status
200
date
Fri, 22 Nov 2019 16:15:54 GMT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by
cache-hhn4041-HHN
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1574439354.483440,VS0,VE0
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
x-amz-request-id
29D722C296265892
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
0
x-cache-hits
5208
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=1232&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1220&an=1017&gi=1&gf=1220&gg=1017&ez=1&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1220&bx=1017&jz=800&dj=1&dx=1&aa=1&ad=1122&cn=919&gn=1&gk=1122&gl=919&cp=1020&cq=1&cr=1&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1020&cd=800&ah=1020&am=800&dq=1020&dr=800&ds=1020&dt=800&zp=0&zx=0&vm=1&vl=234&vt=281&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&ef=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1906461381&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:54 GMT
domains
api.viglink.com/api/
80 B
525 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
3ca7835be88ef09682e1c7e7a150e2b599411124ab102e6f1a475f518fc08ae9

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
80
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=29&q=1&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=1493&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1481&an=1220&gi=1&gf=1481&gg=1220&ez=1&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1481&bx=1220&jz=800&dj=1&dx=1&aa=1&ad=1383&cn=1122&gn=1&gk=1383&gl=1122&cp=1020&cq=1&cr=1&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1484&cd=1020&ah=1484&am=1020&dq=1484&dr=1020&ds=1484&dt=1020&zp=0&zx=0&vm=1&vl=281&vt=342&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&ef=1&eg=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=928144641&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:54 GMT
Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/
15 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5598b49a11a77e2ea02ce80db835ddb9efe7e700264c8a84baa7f01718b44601

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
727983
edge-cache-tag
390516205635749988062413872770256542902,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 18 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/07/Vk_Resizes1000x600_B0_1000x600_English%26IMG%3D1JY9.png
content-length
15341
x-served-by
cache-fra19142-FRA, cache-fra19123-FRA
last-modified
Fri, 18 Oct 2019 07:37:32 GMT
server
cloudinary
x-timer
S1574439355.660491,VS0,VE0
etag
"894bc95894d015f744616075fe104056"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4
56acb1dab722e71a9a72959c85fe6e86.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4368488f6f4897efe452dbd12a1ceeb2f961ec34163c83bde62eb241df4b68c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
1447024
edge-cache-tag
368666536539687455465222014851182150635,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 06 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
content-length
5996
x-served-by
cache-fra19125-FRA, cache-fra19123-FRA
last-modified
Tue, 05 Nov 2019 12:54:17 GMT
server
cloudinary
x-timer
S1574439355.660475,VS0,VE0
etag
"d9d1d4081868afeb327dbb2502480785"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
006.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/006.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5773316fb5438402e1b069fafb7354b62db9eb931ce609e60075f7c80335bf02

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
555030
edge-cache-tag
586334527345271717769465656547011928953,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 17 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/293/006.jpg
content-length
9587
x-served-by
cache-fra19170-FRA, cache-fra19123-FRA
last-modified
Sat, 16 Nov 2019 00:57:03 GMT
server
cloudinary
x-timer
S1574439355.660455,VS0,VE0
etag
"6e6768b718b190e66dc60d74eeddc727"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
c9dd5322c16640ed60fa1a1742aae09c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f74bb59fc5aa63497609a7fdba4089c48a5828a2779620a6a660e6c7a66d6d19

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2540294
edge-cache-tag
351582715293950596603723956480953487256,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
content-length
9517
x-served-by
cache-fra19162-FRA, cache-fra19123-FRA
last-modified
Mon, 07 Oct 2019 18:16:16 GMT
server
cloudinary
x-timer
S1574439355.660438,VS0,VE0
etag
"b0afaa265b55b4f81b54c9cb598ed717"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
ea54e69a63fd41598401962fcba9e157.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/
28 KB
28 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/ea54e69a63fd41598401962fcba9e157.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
b31c01ae5495438ed2c074d17fe43a7271cdd769896d3a68a801873cc0a50e0d

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2090305
edge-cache-tag
470464637142994121872837456985244652427,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 28 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/ea/54/ea54e69a63fd41598401962fcba9e157.jpeg
content-length
28206
x-served-by
cache-fra19166-FRA, cache-fra19123-FRA
last-modified
Mon, 28 Oct 2019 19:01:59 GMT
server
cloudinary
x-timer
S1574439355.660431,VS0,VE0
etag
"aae1d8469717f2911c08614546d100fa"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
4bfc362538b0c9c31abe0b36f5269d4c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4bfc362538b0c9c31abe0b36f5269d4c.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
cc9ddbbc322aaedc11e73f45376ce3b5829f6e88c94e2a7ec8894a46fc5ef7ca

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
2306986
edge-cache-tag
381570778640079623947420830258379876702,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4bfc362538b0c9c31abe0b36f5269d4c.jpg
content-length
7271
x-served-by
cache-fra19145-FRA, cache-fra19123-FRA
last-modified
Thu, 26 Sep 2019 03:02:44 GMT
server
cloudinary
x-timer
S1574439355.660417,VS0,VE0
etag
"0bd77171b2963bd49f2fd15435fe9aeb"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
0859fcb542b50369f7f538b40c10f069.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
12 KB
12 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0859fcb542b50369f7f538b40c10f069.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
58ba62d48b5bfb066e6eb1b745e54943de881794c08cf1512f6743fe6fba1e04

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
444415
edge-cache-tag
491894769881044283164617345348233772719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 03 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0859fcb542b50369f7f538b40c10f069.jpg
content-length
12342
x-served-by
cache-fra19146-FRA, cache-fra19123-FRA
last-modified
Sat, 02 Nov 2019 18:53:32 GMT
server
cloudinary
x-timer
S1574439355.660443,VS0,VE0
etag
"dc30edacc81eda27c4e02f78a496bf75"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
a6bb3db7e3af27a58a60980cc8fff65f.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
9 KB
9 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/a6bb3db7e3af27a58a60980cc8fff65f.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f04010c10191abc17120b2224c754666f8e946a500a22bc20c73aebe141259da

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:15:54 GMT
via
1.1 varnish, 1.1 varnish
age
3681188
edge-cache-tag
618472640262312258893341822006573859338,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 10 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/a6bb3db7e3af27a58a60980cc8fff65f.jpg
content-length
8939
x-served-by
cache-fra19173-FRA, cache-fra19123-FRA
last-modified
Thu, 10 Oct 2019 08:13:18 GMT
server
cloudinary
x-timer
S1574439355.660385,VS0,VE0
etag
"af20c8126940b4c810208b06f2bba0c9"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=1494&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1481&an=1481&gi=1&gf=1481&gg=1481&ez=1&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1481&bx=1481&jz=800&dj=1&dx=1&aa=1&ad=1383&cn=1383&gn=1&gk=1383&gl=1383&cp=1020&cq=1&cr=1&hj=0&pv=0&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1484&cd=1484&ah=1484&am=1484&dq=1484&dr=1484&ds=1484&dt=1484&zp=0&zx=0&vm=1&vl=342&vt=342&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&ef=1&eg=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=37073933&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:54 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2096&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2085&an=1481&gi=1&gf=2085&gg=1481&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2085&bx=1481&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=1987&cn=1383&gn=1&gk=1987&gl=1383&cp=1020&cq=1&cr=1&hj=0&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1887&cd=1484&ah=1887&am=1484&dq=1887&dr=1484&ds=1887&dt=1484&zp=0&zx=0&vm=1&vl=342&vt=481&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2085&fj=0&ef=1&eg=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=926812610&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=2&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=8&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2098&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2085&an=2085&gi=1&gf=2085&gg=2085&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2085&bx=2085&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=1987&cn=1987&gn=1&gk=1987&gl=1987&cp=1020&cq=1&cr=1&hj=0&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1887&cd=1887&ah=1887&am=1887&dq=1887&dr=1887&ds=1887&dt=1887&zp=0&zx=0&vm=1&vl=481&vt=481&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2085&fj=2085&ef=1&eg=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=603048861&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=3&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=9&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2299&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2288&an=2085&gi=1&gf=2288&gg=2085&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2288&bx=2085&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=2190&cn=1987&gn=1&gk=2190&gl=1987&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2088&cd=1887&ah=2088&am=1887&dq=2088&dr=1887&ds=2088&dt=1887&zp=0&zx=0&vm=1&vl=481&vt=528&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2288&fj=2085&ef=1&eg=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=230988628&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=29&q=2&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=10&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2671&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2489&an=2288&gi=1&gf=2489&gg=2288&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2489&bx=2288&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=2391&cn=2190&gn=1&gk=2391&gl=2190&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2492&cd=2088&ah=2492&am=2088&dq=2492&dr=2088&ds=2492&dt=2088&zp=0&zx=0&vm=1&vl=528&vt=574&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2489&fj=2288&ef=1&eg=1&eh=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1093965527&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=4&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=11&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2701&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2689&an=2489&gi=1&gf=2689&gg=2489&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2689&bx=2489&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=2591&cn=2391&gn=1&gk=2591&gl=2391&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2492&cd=2492&ah=2492&am=2492&dq=2492&dr=2492&ds=2492&dt=2492&zp=0&zx=0&vm=1&vl=574&vt=621&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2689&fj=2489&ef=1&eg=1&eh=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=659043171&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=2&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=12&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=2702&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2689&an=2689&gi=1&gf=2689&gg=2689&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2689&bx=2689&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=2591&cn=2591&gn=1&gk=2591&gl=2591&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2692&cd=2492&ah=2692&am=2492&dq=2692&dr=2492&ds=2692&dt=2492&zp=0&zx=0&vm=1&vl=621&vt=621&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=2689&fj=2689&ef=1&eg=1&eh=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=506402039&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:55 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=3&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=13&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=3708&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=3694&an=2689&gi=1&gf=3694&gg=2689&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=3694&bx=2689&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=3596&cn=2591&gn=1&gk=3596&gl=2591&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3697&cd=2692&ah=3697&am=2692&dq=3697&dr=2692&ds=3697&dt=2692&zp=0&zx=0&wa=2&vm=1&vl=621&vt=853&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=3694&fj=2689&ef=1&eg=1&eh=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=2080343542&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:56 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:56 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=29&q=3&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=14&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=3911&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=3900&an=3694&gi=1&gf=3900&gg=3694&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=3900&bx=3694&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=3802&cn=3596&gn=1&gk=3802&gl=3596&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3903&cd=3697&ah=3903&am=3697&dq=3903&dr=3697&ds=3903&dt=3697&zp=0&zx=0&wa=2&vm=1&vl=853&vt=900&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=3900&fj=3694&ef=1&eg=1&eh=1&ei=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=297255508&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:57 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:57 GMT
/
inqlnfvog763mmf771rou737u.litix.io/
0
247 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://www.zdnet.com
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:15:57 GMT
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
POST, GET
/
inqlnfvog763mmf771rou737u.litix.io/
0
172 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/json

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:15:58 GMT
Connection
keep-alive
Content-Length
0
Access-Control-Allow-Methods
POST, GET
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=4&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=15&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=4915&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4903&an=3900&gi=1&gf=4903&gg=3900&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=4903&bx=3900&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=4805&cn=3802&gn=1&gk=4805&gl=3802&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4906&cd=3903&ah=4906&am=3903&dq=4906&dr=3903&ds=4906&dt=3903&zp=0&zx=0&wa=2&hf=1&hi=1&hm=1&vm=1&vl=900&vt=1132&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=4903&fj=3900&ef=1&eg=1&eh=1&ei=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1455285633&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:58 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ad&_vs=s1&_vcs=0&_vvs=0&_vpt=4&_vaup=man&_vplt=0.42.297&_vce=0&c=0.1&W=0&R=0&I=1&E=6&j=20&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:58 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=29&q=4&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=16&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=5013&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4903&an=4903&gi=1&gf=4903&gg=4903&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=4903&bx=4903&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=4805&cn=4805&gn=1&gk=4805&gl=4805&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4906&cd=4906&ah=4906&am=4906&dq=4906&dr=4906&ds=4906&dt=4906&zp=0&zx=0&wa=2&hf=1&hi=1&hm=1&vm=1&vl=1132&vt=1132&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=15&eb=1&ec=10706&fh=2085&fi=4903&fj=4903&ef=1&eg=1&eh=1&ei=1&ej=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=397471918&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:58 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=21&q=0&yco=0&yt=0&xco=0&xt=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=18&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=5016&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4903&an=4903&gi=1&gf=4903&gg=4903&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=4903&bx=4903&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=4805&cn=4805&gn=1&gk=4805&gl=4805&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4906&cd=4906&ah=4906&am=4906&dq=4906&dr=4906&ds=4906&dt=4906&zp=0&zx=0&wa=2&hf=1&hi=1&hm=1&vm=1&vl=1132&vt=1132&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&ea=1&du=15&eb=1&ec=10706&fh=2085&fi=4903&fj=4903&ef=1&eg=1&eh=1&ei=1&ej=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1265753179&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:58 GMT
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=5094&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=5094&ns_st_dpt=5094&ns_st_ipt=5094&ns_st_et=5094&ns_st_det=5094&ns_st_upc=5094&ns_st_dupc=5094&ns_st_iupc=5094&ns_st_upa=5094&ns_st_dupa=5094&ns_st_iupa=5094&ns_st_lpc=5094&ns_st_dlpc=5094&ns_st_lpa=5094&ns_st_dlpa=5094&ns_st_pa=5094&ns_ts=1574439358158&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=5094&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=5094&ns_st_dpt=5094&ns_st_ipt=5094&ns_st_et=5094&ns_st_det=5094&ns_st_upc=5094&ns_st_dupc=5094&ns_st_iupc=5094&ns_st_upa=5094&ns_st_dupa=5094&ns_st_iupa=5094&ns_st_lpc=5094&ns_st_dlpc=5094&ns_st_lpa=5094&ns_st_dlpa=5094&ns_st_pa=5094&ns_ts=1574439358158&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=
Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
master.m3u8
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/
4 KB
1 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/master.m3u8?device=ott&secure=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c75fec46013de758112a168bfb4377880b24ceffdca7a59e7fae42f4f126906e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
content-encoding
gzip
x-cdn
Fastly
age
694642
x-guploader-uploadid
AEnB2UpQ_KH6gSsTQEijzRSZv7PYuC3BJCmgNcZlB_fT8y-RqeMwl9lp6cKHuM6N5DKgrB8YMdiedMC50Y8Wr-BIBFawGmMMKw
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
677
via
1.1 varnish, 1.1 varnish
x-served-by
cache-mdw17328-MDW, cache-hhn4079-HHN
expires
Thu, 14 Nov 2019 15:18:35 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.190242,VS0,VE0
etag
"c87bdd5269068e2fc35fdce31f0d7306"
vary
Accept-Encoding
x-goog-hash
crc32c=TJMsHQ==, md5=yHvdUmkGji/DX9zjHw1zBg==
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0.000013&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0.1&W=0&R=0&I=1&E=6&j=75&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:58 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
stream.m3u8
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
413 B
515 B
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/stream.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
7b9d20858bc032ebfa55673b03d1329609f8e8ab0e9d8eaece5f42653f6272ad

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
content-encoding
gzip
x-cdn
Fastly
age
74589
x-guploader-uploadid
AEnB2UrJ4jkYeYk50UNVAthlzXVWNDv7MfAHIhGXh9FWZhnOHnlGNsL-kn75lV7pvSDxSd3Mttu9Aw9zJ5TIAonqeqH9QBhTs-5A3VwdsBUDysxdB6PXGII
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
215
via
1.1 varnish, 1.1 varnish
x-served-by
cache-mdw17333-MDW, cache-hhn4079-HHN
expires
Thu, 21 Nov 2019 19:32:50 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.213477,VS0,VE0
etag
"4b473e948fb952529ba71ead7893480c"
vary
Accept-Encoding
x-goog-hash
crc32c=J8zS7A==, md5=S0c+lI+5UlKbpx6teJNIDA==
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
2, 1
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=28&q=0&hp=1&wf=1&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRax%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Duny3iPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soBggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=8&g=17&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&fy=207.5&gp=523&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&id=1&f=0&j=&t=1574439353128&de=511633095450&cu=1574439353128&m=5014&ar=56c7b56-clean&iw=b98ba10&cb=0&ym=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=523&lb=3677&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4903&an=4903&gi=1&gf=4903&gg=4903&ez=1&ck=2085&kw=800&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=4903&bx=4903&ci=2085&jz=800&dj=1&dx=1&undefined=1&aa=1&ad=4805&cn=4805&gn=1&gk=4805&gl=4805&co=2190&cp=1020&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4906&cd=4906&ah=4906&am=4906&dq=4906&dr=4906&ds=4906&dt=4906&zp=0&zx=0&wa=2&hf=1&hi=1&hm=1&vm=1&vl=1132&vt=1132&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&ea=1&du=15&eb=1&ec=10706&fh=2085&fi=4903&fj=4903&ef=1&eg=1&eh=1&ei=1&ej=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138292011654&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=zdnet&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=173077&na=1584190211&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 22 Nov 2019 16:15:58 GMT
seg_1.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
940 KB
941 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_1.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
23f083fdb7a2f1ebb56e166dd8fbd6cf347584a28cbdc198beea5de5da0427b0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
454306
x-guploader-uploadid
AEnB2UqRjDlZ2JlfVLKlYVKJkCZt4yTXOJXcfEUqDsdgOrEolD7foAALbFk_U0vIzKC7IJQ6kksOdkbgqCbspaJDRs2-CHTUFtAoCc0ofFt5Ftr84enJPlg
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
962372
x-served-by
cache-mdw17350-MDW, cache-hhn4079-HHN
expires
Sun, 17 Nov 2019 10:04:11 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439358.226405,VS0,VE0
etag
"553fb14355b1d321c6043b7c3b7f4bf5"
x-goog-hash
crc32c=2Bk83Q==, md5=VT+xQ1Wx0yHGBDt8O39L9Q==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
48df4679-2947-478a-8c7b-58859c6a594d
https://www.zdnet.com/
65 KB
0
Other
General
Full URL
blob:https://www.zdnet.com/48df4679-2947-478a-8c7b-58859c6a594d
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Length
66527
Content-Type
text/javascript
stream.m3u8
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
423 B
584 B
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/stream.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
30bbf50cc6d793b443da420f6db23779a2cdb3b903fbcad7c5469aa9ea3eea2e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
content-encoding
gzip
x-cdn
Fastly
age
1240623
x-guploader-uploadid
AEnB2UrMF9SdBZbzBajb2NK_gAfG-iiNjqmd4auciFXV7AV04-p9ma5h3WixTf7hf8laPledkEtKYWB3j8JDtTQotRmGRpRy1A
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
230
via
1.1 varnish, 1.1 varnish
x-served-by
cache-mdw17370-MDW, cache-hhn4079-HHN
expires
Fri, 08 Nov 2019 07:38:54 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.229780,VS0,VE1
etag
"daa29bf0659aa45add8326b94b695913"
vary
Accept-Encoding
x-goog-hash
crc32c=ATaR1w==, md5=2qKb8GWapFrdgya5S2lZEw==
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
4, 1
seg_1.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
97 KB
98 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_1.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
2070e53417e34102b0abc85355224343e118d3bbfc2bd0c90ac9c4ee950be6b3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
2666727
x-guploader-uploadid
AEnB2UrvI7bqDo6OiPg4d4CLjqMaGoZM4fdiN6P_pU7f0r2QhLvgxVbjBtc-4WVv3COTpc3bcD8jhVzuWJF4mlke6NCqyCBciciKs4K-vf7r6BJnolwBA8c
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
99591
x-served-by
cache-mdw17349-MDW, cache-hhn4079-HHN
expires
Tue, 22 Oct 2019 19:30:31 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439358.257344,VS0,VE0
etag
"7ad79e2e4c27889c0199c12f45d0ab02"
x-goog-hash
crc32c=/IQeXQ==, md5=eteeLkwniJwBmcEvRdCrAg==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
5bed82da-793b-4249-be70-2bdec024d919
https://www.zdnet.com/
65 KB
0
Other
General
Full URL
blob:https://www.zdnet.com/5bed82da-793b-4249-be70-2bdec024d919
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Length
66527
Content-Type
text/javascript
seg_2.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1004 KB
1005 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_2.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
e55319d6eccb80ea00bca763ab145ac8105ace1e12e8a6c1c25b9612ad32f3a6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
389726
x-guploader-uploadid
AEnB2Uo5lu5E8Q_FPBjusuPtIgaj0vLZwH5YiiJBIZfAtLj8KXwSnNDC-v9rLPr8YoeXmUFIgBZYwiDzymT4W9E6Z_CU6PxTPPHYHyRHtOOJxanGowagRhw
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1028548
x-served-by
cache-mdw17348-MDW, cache-hhn4079-HHN
expires
Mon, 18 Nov 2019 04:00:32 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.323864,VS0,VE1
etag
"3306f7a237ea9de7695e1b6634ffc2ce"
x-goog-hash
crc32c=Ic41aQ==, md5=Mwb3ojfqnedpXhtmNP/Czg==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_2.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
95 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_2.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4289d88fd1584fc618b9596e35f29b2def5d0822c6029f40b6380ac9df530e56

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
2666727
x-guploader-uploadid
AEnB2UoyYuGN_eto_9dVxRn5rqNKrOlthqKEgdhzg7BRmbnUkhadlmoA_m0AO0Ff_q0S71p7MuHJaDjuOgnR6CSknaBg8vka_CCdzVHH_R-a_YsUixDOWxc
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
97745
x-served-by
cache-mdw17381-MDW, cache-hhn4079-HHN
expires
Tue, 22 Oct 2019 19:30:31 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439358.328218,VS0,VE0
etag
"10a30e2632c0cfaa0ef693accbfc5d87"
x-goog-hash
crc32c=5VXNnA==, md5=EKMOJjLAz6oO9pOsy/xdhw==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.000194&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0.11&W=0&R=1&I=0&E=6&j=20&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:58 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
seg_3.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
96 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_3.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
f209dda944040e3007e7eca9fd1c35c9a64a39c7763cb10c7da611c015ba6d72

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
822998
x-guploader-uploadid
AEnB2Up7EjiZxWJinig65jBs8RLgywKlAFcEcWPFqruT_UxcnzhYrL_ufp3zkZMRAOCgHKzPOUqsqcD2H8a7YKdJgaHmv063xw
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
98133
x-served-by
cache-mdw17324-MDW, cache-hhn4079-HHN
expires
Wed, 13 Nov 2019 03:39:20 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439358.395689,VS0,VE0
etag
"69efc6ac890c6c558b9369be04b646b2"
x-goog-hash
crc32c=AcK+gw==, md5=ae/GrIkMbFWLk2m+BLZGsg==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_3.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_3.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
9bdb7fa85c0730401229a81e4f9f1d13f6ab6db034b692e8cc1885d361ca218f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
973368
x-guploader-uploadid
AEnB2Upzyiuy-c5Vb-Y3FD9rvaN0bzgShpYliq9E0y0-HI9vwygkMMYtjHyJZlif056wwJYXwXUzxMcmR-uf1xVFdZLagINDJQ
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1166164
x-served-by
cache-mdw17380-MDW, cache-hhn4079-HHN
expires
Mon, 11 Nov 2019 09:53:09 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.400083,VS0,VE1
etag
"a65df8fb2a2558cbfceaed52d43a4ada"
x-goog-hash
crc32c=HLVlxw==, md5=pl34+yolWMv86u1S1DpK2g==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_4.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
95 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_4.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
272fde029afd83c4ce7ef802994ffbcb31fc563c7c79ddfba6961608afe3aa42

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1235763
x-guploader-uploadid
AEnB2Uqh52hcLJRy27HvO0xakcy-PKB9-_zJJi9ahJrOYcg2ROJdgJfvk6_H3x592OmjuQHsFpeMNkuBwqqPsuvdkCfUTXbTcA
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
97739
x-served-by
cache-mdw17321-MDW, cache-hhn4079-HHN
expires
Fri, 08 Nov 2019 08:59:55 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439358.410529,VS0,VE0
etag
"cc5384e02fe89259509712574827a9c4"
x-goog-hash
crc32c=oEQBdg==, md5=zFOE4C/okllQlxJXSCepxA==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_5.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
95 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_5.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
82b3db0559aa155e9b36870b6e2913c7b2a94ab9faed6bb8330dc279400bc2f7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
2666725
x-guploader-uploadid
AEnB2UqFTgVJ0ltEkLWEs_vb7fb_VDF0MRFe4J3MHJsCTnCrYW1SCxYeE_IpktQqnMBjpLp16T_UZEu41-PHorgzo7UYIMDX3BrWR3Ulif9CtwMboqGm_L4
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
97678
x-served-by
cache-mdw17349-MDW, cache-hhn4079-HHN
expires
Tue, 22 Oct 2019 19:30:32 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.443999,VS0,VE0
etag
"6e94ec62ef1d943862dc3f4d3e387070"
x-goog-hash
crc32c=VaBxAA==, md5=bpTsYu8dlDhi3D9NPjhwcA==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_6.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
96 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_6.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
039a6d68ca32558b707e0b3f94ee7260020286866f0d4065acf7dccbf67e1187

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
74696
x-guploader-uploadid
AEnB2UqoKxq8YgCcGeQ58EQAwm5T0Q4bD1Sza12HU88p785IAoF1mzKRGP8W5z7cEhvngx6pbkBj_CqobaHdVUChHoH3g1uTjQnZgu7ii44j0H2lwAbT8Go
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
98071
x-served-by
cache-mdw17370-MDW, cache-hhn4079-HHN
expires
Thu, 21 Nov 2019 19:31:02 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.462578,VS0,VE0
etag
"1ca6a7120da05aea1b955a9d79eb65dd"
x-goog-hash
crc32c=uzsfMw==, md5=HKanEg2gWuoblVqdeetl3Q==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_4.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_4.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
f41d7a7931045aada7ef8db5efbaff0857f470408229383c5103dfc488708853

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1060037
x-guploader-uploadid
AEnB2UoILhYA2W5QDvZUlxNqh3FmQXyo3OSq3_9y0-B_amibH-tG-sGEzPyGvw4lPevvyGvi9HJPp-lt7e98Eq1TaiNZI7DCRnB14i9E13CHZ_f6tyWIWmM
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1265804
x-served-by
cache-mdw17368-MDW, cache-hhn4079-HHN
expires
Sun, 10 Nov 2019 09:48:40 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439358.491270,VS0,VE1
etag
"250943f9751cebdb9faa4b9612eba5e4"
x-goog-hash
crc32c=PnWFsQ==, md5=JQlD+XUc69ufqkuWEuul5A==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
p
sb.scorecardresearch.com/
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=end&ns_st_po=5094&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=5094&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=5455&ns_st_det=361&ns_st_upc=5094&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=5094&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=5094&ns_st_dlpc=0&ns_st_lpa=5094&ns_st_dlpa=0&ns_st_pa=5094&ns_ts=1574439358519&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
p
sb.scorecardresearch.com/
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1574439352071&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=2&ns_st_ev=play&ns_st_po=0&ns_st_cl=57000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=5094&ns_ts=1574439358521&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C0_42_297&c4=3000074&c6=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c8=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:15:58 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
seg_5.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_5.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
783723282e302e6ef8cf6388500e6f79ba4c2e75ad3d722f29e433ac1957d671

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1212241
x-guploader-uploadid
AEnB2UrnM2s9t3oldiMOf7hN-9exSXbF4nxuPCWetzf-i_g-WiYuQyhPi6o4WSlOK2s3S3raAsx6PExdsbImVcHdNKuGukjdwSSntPuFEeYNcTusCycwlgk
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1199628
x-served-by
cache-mdw17328-MDW, cache-hhn4079-HHN
expires
Fri, 08 Nov 2019 15:31:56 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.567730,VS0,VE0
etag
"0308532f52ea9f1418f99163de9b083a"
x-goog-hash
crc32c=eI38Tw==, md5=AwhTL1LqnxQY+ZFj3psIOg==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=play&l:event:duration=5076&l:event:playhead=0&l:event:ts=1574439358159&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:asset:ad_id=4574368938&s:asset:ad_sid=1574439353082697287417&s:asset:resolver=UVPJS_0.42.297&s:asset:pod_id=ead9b3358912cd43a67e1991faf78f39_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_2019_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_2019_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:17:11 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EEC04DA85159303-6000085526D27B7A&s:user:mid=00754888887602075713342477076251741235&s:aam:blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1574439353075526044566&s:event:type=complete&l:event:duration=0&l:event:playhead=0&l:event:ts=1574439358159&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&s:asset:video_id=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=57&s:asset:ad_id=4574368938&s:asset:ad_sid=1574439353082697287417&s:asset:resolver=UVPJS_0.42.297&s:asset:pod_id=ead9b3358912cd43a67e1991faf78f39_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_2019_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_2019_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.12.217 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-12-217.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:15:58 GMT
X-VaRouter-Backend
prod19
Server
nginx
Connection
keep-alive
seg_6.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_6.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
713a9c8e74072b9615bfe3142203093b8c79d190172518d6d536bd0663b3095a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1243546
x-guploader-uploadid
AEnB2UrZ18KagNviFuD3CKqKUEfXde9ymLKqvzWsZhupAXVsGO7hi1_Zo5cMQLiSLjK4PSp47NNFB4Ma3JIbVxYjg0EVZeC6LZs3r3qXVSCuo5ul8mmR2mk
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1090400
x-served-by
cache-mdw17358-MDW, cache-hhn4079-HHN
expires
Fri, 08 Nov 2019 06:50:12 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.620831,VS0,VE0
etag
"0bd675433379781cee40f693081545d3"
x-goog-hash
crc32c=wJ0fWA==, md5=C9Z1QzN5eBzuQPaTCBVF0w==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_7.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
997 KB
998 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_7.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
5fda881273604acb5ae18d290d8d806011e8d3f853fd5ab1161308d3266b1fb0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
987757
x-guploader-uploadid
AEnB2UosqPzgW6CV0NKfBFyBDZ6KF92K9yt8280AElU346AUeB6ldpSoY2ZSRvVFU2-_8s9rAGoIVRDsvUwnqHXc-QJboWRgqAVSCTPzDVwoG0iG3Ll5pPU
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1021028
x-served-by
cache-mdw17375-MDW, cache-hhn4079-HHN
expires
Mon, 11 Nov 2019 05:53:21 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.679435,VS0,VE1
etag
"e5df280234b4b74864b12bba32febc84"
x-goog-hash
crc32c=LuLRPQ==, md5=5d8oAjS0t0hksSu6Mv68hA==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_8.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_8.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
93296441bb07b4162bd10108aecc8a1b485019093f269635f630d5f1ea4b6fd8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
2666650
x-guploader-uploadid
AEnB2UrV9rrfcM7GAVr9J1b5vZN8x7KW41IuX2G6nWOceUxmmANwWLjax89YtWP5wV0pfnkkbaEl-01BWhlUXP95RlkOrGfA0w
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1278400
x-served-by
cache-mdw17364-MDW, cache-hhn4079-HHN
expires
Tue, 22 Oct 2019 19:31:46 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.724988,VS0,VE1
etag
"d2bf55d90c66f5a68d2b791fc6adc134"
x-goog-hash
crc32c=6l+MnA==, md5=0r9V2Qxm9aaNK3kfxq3BNA==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_9.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_9.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
dda8aff432680cbb14ba8036d98178bdc8960a42e1aaee355b46feb65e66e8fb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1060028
x-guploader-uploadid
AEnB2Uq-wROOlV81qxeSjadrtRegzk1YtU1f3g3YO60ru4t_2CLE9n9LVu1GT3HFWNAO9ru2arUDK8gyo8LNZTVabyueXT_dPA
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
1441584
x-served-by
cache-mdw17377-MDW, cache-hhn4079-HHN
expires
Sun, 10 Nov 2019 09:48:50 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439359.775739,VS0,VE1
etag
"09cf06ea6946e8ee00c7d65070aa1b54"
x-goog-hash
crc32c=C+J1wQ==, md5=Cc8G6mlG6O4Ax9ZQcKobVA==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_7.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
95 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_7.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4da29b1e6e6c2ad36d448d129a924763a0a66b35d94c2a82467090ac1efff358

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
888196
x-guploader-uploadid
AEnB2UpCdyvtGv4U7ZPQShRLULwesnb2Powz16ReRyqBIBCVQTJ4vGGxzFYyEwZDchEhceAlXA-i0ZgZDtChLXDGzFwd5lFcUeE3igUIiYw-BFqaS35LNXI
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
97781
x-served-by
cache-mdw17323-MDW, cache-hhn4079-HHN
expires
Tue, 12 Nov 2019 09:32:42 GMT
last-modified
Fri, 18 Oct 2019 22:06:12 GMT
server
UploadServer
x-timer
S1574439359.814290,VS0,VE1
etag
"e2b706f49fe360847a82814f04bd8e4f"
x-goog-hash
crc32c=HQizVQ==, md5=4rcG9J/jYIR6goFPBL2OTw==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
41, 1
seg_8.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
96 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_8.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
18a1ef1b11c4448f6d4044b61d673785e24e14f7002d253e918bb16a33472b63

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
2666724
x-guploader-uploadid
AEnB2UpPoIEWqdkMYIsiaQPK8nzJtlhS2SWyFhP7XbQAX1HgEUfLpoS2tZhd14uwnxJg6yEkLERjUv-5cFQQfZehNfvlPLxU4C5rL8pz4w7yiAosvVf5OIg
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
98123
x-served-by
cache-mdw17377-MDW, cache-hhn4079-HHN
expires
Tue, 22 Oct 2019 19:30:34 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.826085,VS0,VE1
etag
"3993a2467f9664d614447cda51f17084"
x-goog-hash
crc32c=lN2H1w==, md5=OZOiRn+WZNYURHzaUfFwhA==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
851, 1
seg_10.ts
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/
103 KB
103 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_1500/seg_10.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
14a51810046204d009dbe20748db4e2e2d8bd113a7b3942ff1cdca711850d966

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
1007728
x-guploader-uploadid
AEnB2UpCq69nDWgEYwwzzY3HhvpqaFh7gy2ynux9cOK4m0iC3bWIXdVt7c8ffI87k_cd4LxvNffO2XYIGQNklWb1qMmtG7SWQw
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
105280
x-served-by
cache-mdw17357-MDW, cache-hhn4079-HHN
expires
Mon, 11 Nov 2019 00:20:31 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.830088,VS0,VE1
etag
"3a7e0eb99f9cefd4690d58776afa2c3c"
x-goog-hash
crc32c=/bbMog==, md5=On4OuZ+c79RpDVh3avosPA==
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_9.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
95 KB
96 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_9.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
d0248a53ad240633172443f8e29edca4f57239c5911eed449808738817ab3cb4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
74695
x-guploader-uploadid
AEnB2Ur3GP8G5uzULZXmti3bMJkEaWBs3We8mYZ3JuFJZRdgLcJGntvF6dXrD-8D6AtSbSPwc5AjXkcy1DHR_xkwmxEpAvEqIOl38trXpxzpgXKERnTca1c
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
97733
x-served-by
cache-mdw17358-MDW, cache-hhn4079-HHN
expires
Thu, 21 Nov 2019 19:31:03 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.837308,VS0,VE1
etag
"2e4ff590a67c33f90bf18b35ce312f65"
x-goog-hash
crc32c=1g5xNA==, md5=Lk/1kKZ8M/kL8Ys1zjEvZQ==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
1, 1
seg_10.aac
techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aa...
43 KB
43 KB
XHR
General
Full URL
https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/2019-10-18-wochit-ransomware-why-were-still-losing-the-fight-and-the-changes-you-need-to-make-before-its-too-late_1954507_aac_128/seg_10.aac
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
UploadServer /
Resource Hash
81a58684a9ef16f6f2ca46a579a71a25bdc28a7cbd913386e14b2dad527c8a3d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com

Response headers

date
Fri, 22 Nov 2019 16:15:58 GMT
via
1.1 varnish, 1.1 varnish
x-cdn
Fastly
age
74695
x-guploader-uploadid
AEnB2UoLh1rRQlxiUy8yd8Km5ezqCeytSGUwtm14A-xytWDJUEwBM_SSWIsR4ZtF5vFULhfWWZjizMtp_DBMsxjgDnfwrr16gfHZgKyM1o63b0C8iW-7JDc
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
status
200
content-length
43616
x-served-by
cache-mdw17366-MDW, cache-hhn4079-HHN
expires
Thu, 21 Nov 2019 19:31:03 GMT
last-modified
Fri, 18 Oct 2019 22:06:11 GMT
server
UploadServer
x-timer
S1574439359.848633,VS0,VE1
etag
"58fba1cb2a7ee60750d817c4bd1e6c5b"
x-goog-hash
crc32c=M2NOPA==, md5=WPuhyyp+5gdQ2BfEvR5sWw==
content-type
audio/aac
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
X-CDN
cache-control
private, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
x-shield
MediaShield-Region: Central, Region-Status: primary
x-cache-hits
2, 1
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&u=BFQykADY90wre1v8I&d=zdnet.com&g=65713&g0=security&g1=steve%20ranger&n=1&f=00001&c=0.23&x=0&m=0&y=3677&o=1585&w=1200&j=30&R=1&W=0&I=0&E=10&e=4&r=&b=3214&t=CJxdZGYDPT_iTFbdDSiZVuz9xs8&V=118&tz=-60&_acct=anon&_vi=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&_vp=https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/master.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=57000&sn=3&sv=UxC0MB9Ok9vI1EqPYseSD5VS2H&sd=1&im=067b2ef3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:15:59 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
gn
secure-us.imrworldwide.com/cgi-bin/
44 B
425 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=us-700144&ch=us-700144_c01_P&asn=defChnAsset&sessionId=nd09xx2sKvdVS9NLLe9ynnsbsL1Wg1574439352&tl=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&prv=1&c6=vc,c01&ca=us-700144_c01_db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&cg=ZDNet%20Video&c13=asid,PF7B87067-BF4D-F80F-E040-070AAD316CE6&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,UVPJS|0_42_297&plugv=&playerv=&sup=0&segment2=&segment1=&forward=1&ad=0&cr=4_00_99_V1_00000&c9=devid,&enc=true&c1=nuid,999&at=view&rt=video&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,15744393522333440&c30=bldv,6.0.0.440&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&sd=57&devtypid=&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&c3=st,c&c64=starttm,1574439358&adid=db98b3b3-4b65-498d-98f5-2cf87fe1d2d3&c58=isLive,false&c59=sesid,LbZLl8eLYfzXXPxc1ddyiKzukLlEz1574439359&c61=createtm,1574439359&c63=pipMode,&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c77=adsuprt,1&uoo=&evdata=&c71=ottflg,0&c72=otttyp,none&c44=progen,&davty=0&si=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488&c66=mediaurl,&c62=sendTime,1574439359&rnd=173833
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.205.213 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-205-213.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:59 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/
44 B
424 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15744393522333440&c30=bldv,6.0.0.440&c6=vc,c01&c3=&cg=ZDNet%20Video&tl=dav0-We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&pr=iag.epi,We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1574439359&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1574439359&rnd=672419
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.205.213 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-205-213.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 16:15:59 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&u=BFQykADY90wre1v8I&d=zdnet.com&g=65713&g0=security&g1=steve%20ranger&n=1&f=00001&c=0.25&x=0&m=0&y=3677&o=1585&w=1200&j=45&R=0&W=0&I=1&E=10&e=0&r=&b=3214&t=CJxdZGYDPT_iTFbdDSiZVuz9xs8&V=118&tz=-60&_acct=anon&_vi=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&_vp=https://techrepublicvideo.cbsistatic.com/vr/2019/10/18/1626644547655/1954507_hls/master.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=57000&sn=4&sv=UxC0MB9Ok9vI1EqPYseSD5VS2H&sd=1&im=067b2ef3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:16:00 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif
imsync.ashx
ml314.com/
17 B
427 B
Script
General
Full URL
https://ml314.com/imsync.ashx?pi=3606235184319954949&data=eyJwaCI6MzA3Niwid2giOjEyMDAsInRicyI6MCwiZHQiOjE1LCJwaWQiOiIxNTc0NDM5MzQ2MDc4X2NtajhrNXZ4dSIsInNkIjoxMjAwfQ%3D%3D
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?22102019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.143.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-143-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
62ce950ad0d7f664b316b4253bbc993bf0bf8310970f64b150fda6f1fa59dfea

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 16:16:00 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Cache-Control
private
Connection
keep-alive
Content-Length
135
/
www.zdnet.com/homepage/xhr/
253 KB
27 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6d84befe4164365ab97a8048442cfcec0e3393d4fd2cfbb62c79457dac821f25
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
27050
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 22 Nov 2019 16:16:02 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:16:02 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
99ccbd49-1ca5-4dcf-b760-48e3af61497c
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Fri, 22 Nov 2019 17:46:02 GMT
ring.gif
zdnet1.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/ring.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86623
status
200
strict-transport-security
max-age=31536000
content-length
9039
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b4f0-3f75"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:16 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86624
status
200
strict-transport-security
max-age=31536000
content-length
1513
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b4f0-6fa"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:16 GMT
ZDLogoMicroWhite-x2.png
zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/
2 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1574352112-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/1864-fly/css/core/main-f23f75230f-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86628
status
200
strict-transport-security
max-age=31536000
content-length
1398
x-xss-protection
1; mode=block
last-modified
Thu, 21 Nov 2019 16:01:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd6b4f0-691"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 16:12:06 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
753 B
534 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
116963
status
200
strict-transport-security
max-age=31536000
content-length
426
x-xss-protection
1; mode=block
last-modified
Wed, 20 Nov 2019 17:04:32 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd57220-2f1"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2019 07:46:38 GMT
tr-premium-promo-49ebdaab89-rev.js
zdnet2.cbsistatic.com/fly/js/components/
461 B
434 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
275642
status
200
strict-transport-security
max-age=31536000
content-length
287
x-xss-protection
1; mode=block
last-modified
Mon, 18 Nov 2019 09:21:31 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5dd2629b-1cd"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 11:42:00 GMT
image-gallery-modal-e49526b449-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
374534
status
200
strict-transport-security
max-age=31536000
content-length
1909
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2019 19:39:32 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dcdad74-13d0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2019 08:13:48 GMT
load-more-34f6119ea4-rev.js
zdnet3.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
300766
status
200
strict-transport-security
max-age=31536000
content-length
1803
x-xss-protection
1; mode=block
last-modified
Mon, 18 Nov 2019 09:21:31 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd2629b-12a2"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 04:43:13 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3a7816292dc688561de01122dae9125040e935ca2ca03059f37844dfeecc0aec
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
762
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:16:02 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
d13e2a32-ac06-4d22-8943-02d830f6d00c
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 22 Nov 2019 16:16:02 GMT
/
www.zdnet.com/m3d0s1/xhr/horizontal/
14 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8ea876814a2451547eb13fe4fd0ca9d9f2e07ccec70c7bbc3d4f9a57efe909f2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1707
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:16:02 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
421eeab2-6ca6-43ed-b44d-a2f8c104db09
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 22 Nov 2019 16:16:02 GMT
/
www.zdnet.com/components/tr-promo-asset/xhr/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1864-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d148114905f1f24b1b2d566c8d8d3f510cb616208f0d03e9f3beacd09bc56ff7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
660
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 22 Nov 2019 15:07:31 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Fri, 22 Nov 2019 16:16:02 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
5722cb3c-60b2-4f77-8bcf-4bf550afe3fc
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Fri, 22 Nov 2019 16:37:31 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/
8 KB
3 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1864-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
252512
status
200
strict-transport-security
max-age=31536000
content-length
2472
x-xss-protection
1; mode=block
last-modified
Tue, 19 Nov 2019 16:06:40 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd41310-1f51"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 18:07:29 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
313717
status
200
strict-transport-security
max-age=31536000
content-length
3552
x-xss-protection
1; mode=block
last-modified
Mon, 18 Nov 2019 09:18:33 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5dd261e9-f53"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Nov 2019 01:07:24 GMT
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
7 KB
3 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=17%3A16%3A02.742&lti=deflated&data=%7B%22id%22%3A725%2C%22ii%22%3A%22%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1574439354271%2C%22cv%22%3A%2220191120-8-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A7835%2C%22qs%22%3A%22%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A7279.53125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
2b4b9fd7115437f7483cecf0e6b4029a0c99b1dead67f025fe28d5b478271dac

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-vcl-time-ms
149
date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
via
1.1 varnish
x-served-by
cache-hhn4041-HHN
server
nginx
x-timer
S1574439363.753579,VS0,VE149
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
content-encoding
gzip
cf-cache-status
HIT
age
138810
status
200
content-type
text/javascript
content-length
27746
x-amz-id-2
L1s8Yh+CMGwzqWrO24gvwL3s9QCXaLs9ZYTFAF9q0BVy9FqATw+dPLawpww8YBEYhnx1eLyb3k0=
last-modified
Mon, 21 Oct 2019 20:13:23 GMT
server
cloudflare
etag
"df893ab92782cedac4da4785df9ec68e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
90620ADCD4F2320F
cache-control
max-age=1800, must-revalidate
accept-ranges
bytes
cf-ray
539c34a218865964-VIE
0.840590781894908
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
209 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.840590781894908?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=this+fake+software+update+tries+to+download+malware+onto+your+pc+even+when+you+click+%27later%27&v22=content_article&v23=&v24=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&v30=62369aaf-e86b-4001-867b-aca2cb3b822f&v60=33162210,177470,177469,33165211&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201911220-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.91.36 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-181-91-36.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
x-content-type-options
nosniff
x-c
master-1061.Iecc33a.M0-311
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 23 Nov 2019 16:16:02 GMT
server
jag
xserver
anedge-5fc496b8d4-n86mf
etag
3381082784747847680-4617961286810210839
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 21 Nov 2019 16:16:02 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=62369aaf-e86b-4001-867b-aca2cb3b822f&assettitle=this%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20pc%20even%20when%20you%20click%20%27later%27&assettype=content_article&pubdate=2019-11-21%2012%3A44%3A00&viewguid=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&devicetype=desktop&sitetype=responsive%20web&author=steve%20ranger&authorid=5cae6838-8176-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=62369aaf-e86b-4001-867b-aca2cb3b822f&v16=69979fa5-eefd-4b55-ab48-c45a8da1cd4d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1574439362889&tcset=utf8&im=dsjs&title=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D22255429125791934258675598500488
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 16:16:02 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=170
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
193 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
17
date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4041-HHN
pragma
no-cache
server
nginx
x-timer
S1574439363.944274,VS0,VE17
content-type
image/gif
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
/
inqlnfvog763mmf771rou737u.litix.io/
0
247 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://www.zdnet.com
Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:16:02 GMT
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
POST, GET
56acb1dab722e71a9a72959c85fe6e86.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4368488f6f4897efe452dbd12a1ceeb2f961ec34163c83bde62eb241df4b68c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
1447032
edge-cache-tag
368666536539687455465222014851182150635,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 06 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
content-length
5996
x-served-by
cache-fra19125-FRA, cache-fra19123-FRA
last-modified
Tue, 05 Nov 2019 12:54:17 GMT
server
cloudinary
x-timer
S1574439363.947492,VS0,VE0
etag
"d9d1d4081868afeb327dbb2502480785"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
002.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/002.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1eff300c2d90f7744943dfca8270dcddcc7cfe4ea6e4f52c8db039b1efb9c67c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
646888
edge-cache-tag
309702307073767404854975536479623263921,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 16 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/002.jpg
content-length
7396
x-served-by
cache-fra19123-FRA, cache-fra19123-FRA
last-modified
Fri, 15 Nov 2019 00:26:33 GMT
server
cloudinary
x-timer
S1574439363.947912,VS0,VE0
etag
"092df9ef60cbcdf05cc0b2d26a3fcf55"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1560
c9dd5322c16640ed60fa1a1742aae09c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191120-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f74bb59fc5aa63497609a7fdba4089c48a5828a2779620a6a660e6c7a66d6d19

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
2540302
edge-cache-tag
351582715293950596603723956480953487256,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
content-length
9517
x-served-by
cache-fra19162-FRA, cache-fra19123-FRA
last-modified
Mon, 07 Oct 2019 18:16:16 GMT
server
cloudinary
x-timer
S1574439363.948245,VS0,VE0
etag
"b0afaa265b55b4f81b54c9cb598ed717"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 3
666837059a0f48699514a37519bfbb79.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/
29 KB
30 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/666837059a0f48699514a37519bfbb79.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
14fadfb54f2da8d41bb138858eed71c8fe2bca5e8751ed7bc97a4ef35a9963e0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
2143813
edge-cache-tag
378912377187674945178139457134138802714,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 28 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/666837059a0f48699514a37519bfbb79.jpeg
content-length
29892
x-served-by
cache-fra19138-FRA, cache-fra19123-FRA
last-modified
Mon, 28 Oct 2019 15:08:49 GMT
server
cloudinary
x-timer
S1574439363.948905,VS0,VE1
etag
"c7bd70d979572e0577d7910060440961"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
56acb1dab722e71a9a72959c85fe6e86.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4368488f6f4897efe452dbd12a1ceeb2f961ec34163c83bde62eb241df4b68c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
1447032
edge-cache-tag
368666536539687455465222014851182150635,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 06 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/56acb1dab722e71a9a72959c85fe6e86.jpg
content-length
5996
x-served-by
cache-fra19125-FRA, cache-fra19123-FRA
last-modified
Tue, 05 Nov 2019 12:54:17 GMT
server
cloudinary
x-timer
S1574439363.972317,VS0,VE0
etag
"d9d1d4081868afeb327dbb2502480785"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4
002.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/002.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1eff300c2d90f7744943dfca8270dcddcc7cfe4ea6e4f52c8db039b1efb9c67c

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
646888
edge-cache-tag
309702307073767404854975536479623263921,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 16 Dec 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/xwatch/292/002.jpg
content-length
7396
x-served-by
cache-fra19123-FRA, cache-fra19123-FRA
last-modified
Fri, 15 Nov 2019 00:26:33 GMT
server
cloudinary
x-timer
S1574439363.972966,VS0,VE0
etag
"092df9ef60cbcdf05cc0b2d26a3fcf55"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1561
c9dd5322c16640ed60fa1a1742aae09c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f74bb59fc5aa63497609a7fdba4089c48a5828a2779620a6a660e6c7a66d6d19

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
2540302
edge-cache-tag
351582715293950596603723956480953487256,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9dd5322c16640ed60fa1a1742aae09c.png
content-length
9517
x-served-by
cache-fra19162-FRA, cache-fra19123-FRA
last-modified
Mon, 07 Oct 2019 18:16:16 GMT
server
cloudinary
x-timer
S1574439363.972920,VS0,VE0
etag
"b0afaa265b55b4f81b54c9cb598ed717"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 4
666837059a0f48699514a37519bfbb79.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/
29 KB
30 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/666837059a0f48699514a37519bfbb79.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
14fadfb54f2da8d41bb138858eed71c8fe2bca5e8751ed7bc97a4ef35a9963e0

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 16:16:02 GMT
via
1.1 varnish, 1.1 varnish
age
2143813
edge-cache-tag
378912377187674945178139457134138802714,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 28 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/66/68/666837059a0f48699514a37519bfbb79.jpeg
content-length
29892
x-served-by
cache-fra19138-FRA, cache-fra19123-FRA
last-modified
Mon, 28 Oct 2019 15:08:49 GMT
server
cloudinary
x-timer
S1574439363.981940,VS0,VE0
etag
"c7bd70d979572e0577d7910060440961"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
/
inqlnfvog763mmf771rou737u.litix.io/
0
172 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-154-10.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/json

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 22 Nov 2019 16:16:03 GMT
Connection
keep-alive
Content-Length
0
Access-Control-Allow-Methods
POST, GET
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=https%3A%2F%2Ftechrepublicvideo.cbsistatic.com%2Fvr%2F2019%2F10%2F18%2F1626644547655%2F1954507_hls%2Fmaster.m3u8&i=We%20are%20losing%20the%20ransomware%20fight%3A%20This%20is%20why&g0=security&g1=steve%20ranger&u=BQ3IFMg5zDBBK-GAn&t=RKeHdCKE-qSDl8teu9FBEdCZncnc&x=0&y=0&V=118&VS=VS&n=1&b=9130&_vd=57000&_vi=This%20fake%20software%20update%20tries%20to%20download%20malware%20onto%20your%20PC%20even%20when%20you%20click%20%27later%27%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fthis-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later%2F&_vh=zdnet.com&_pu=BFQykADY90wre1v8I&_pt=CJxdZGYDPT_iTFbdDSiZVuz9xs8&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.005194&_vpt=4.843236&_vaup=man&_vplt=0.42.297&_vce=5&c=0.19&W=0&R=1&I=0&E=11&j=20&tz=-60&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.197.16 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-197-16.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 22 Nov 2019 16:16:03 GMT
cache-control
no-cache, no-store, must-revalidate
expires
0
content-length
43
content-type
image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
z.moatads.com
URL
https://z.moatads.com/cbsprebidheader506831276743/moatheader.js

Verdicts & Comments Add Verdict or Comment

317 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| _sf_async_config number| _sf_startpt object| _cbq object| knownServiceWorkers object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define function| $ function| jQuery number| BOOMR_lstart object| _sp_ object| BOOMR object| BOOMR_mq function| renderAdCallback function| blankAdCallback object| jQuery183028043828265853254 number| BOOMR_configt object| googletag object| ggeac object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| _bmrEvents number| google_srt object| closure_memoize_cache_ undefined| google_measure_js_timing undefined| easyXDM object| AudEng object| URS object| Modernizr function| Waypoint number| _sf_endpt function| VideoStrategy object| _cbv_strategies object| debug object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om object| _cb_shared object| pSUPERFLY_mab object| pSUPERFLY object| pSUPERFLY_video object| _cbv object| CryptoJS object| mPulseApp object| _ml boolean| __v5k function| vl_cB function| vl_disable function| vglnk_15744393457186 function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in function| Visitor object| visitor function| DIL number| s_objectID number| s_giq function| dw_callback function| lightboxjs function| lightboxlib object| EF undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming object| TRUE_ANTHEM object| DIGIOH_API object| LIGHTBOX_API undefined| vglnk_15744393462197 object| headertag function| headertag_render object| pbjs undefined| jQuery17109466020999926208_1574439345911 undefined| vglnk_15744393494459 undefined| ct undefined| et undefined| hourElapsed undefined| msg undefined| pixelDomain undefined| isDomless undefined| documentReferrer undefined| isBeta undefined| viewHash undefined| pxSrc undefined| px object| Moat#G26 object| MoatSuperV26 object| MoatNadoAllJsonpRequest_19296439 object| Moat#PML#26#1.2 boolean| Moat#EVA object| MoatDataJsonpRequest_19296439 object| moatPrebidApi function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr object| DW object| s_i_cnetzdnetglobalsite object| __ql string| path string| host object| scriptTags object| jQuery17109466020999926208 string| adBlockCookieValue object| $tealium number| BOOMR_onload object| ret boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey function| udm_ function| ns_order object| ns_ object| ns_p function| fbq function| _fbq string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url object| UA object| trx number| _rnd string| __prot object| __i object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| google object| QSI object| ADB object| NOLCMB object| platform function| mux object| closure_lm_307172 object| NOLBUNDLE object| closure_lm_622553 object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents undefined| GLOBAL_VAR object| TRC object| _tblConsole object| _taboola object| _comscore string| pm_pgtp object| COMSCORE function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| vglnk_157443935367510 number| taboola_view_id undefined| vglnk_157443935461411

17 Cookies

Domain/Path Name / Value
.demdex.net/ Name: dextp
Value: 269-1-1574439349763|477-1-1574439349865|771-1-1574439349966|22052-1-1574439350067|30646-1-1574439350169|121998-1-1574439350270|70027-1-1574439350371
.demdex.net/ Name: demdex
Value: 00978766688924010673329663983030683979
.lightboxcdn.com/ Name: a1583f50-579b-41d0-8c4e-1cd1790d945c
Value: N4Ig-mBGAeDGCuAnRIBcoAOGAuBnNAjAKwDsALGQMwCclRxRAbADQgYBusAdtoa7vlTFyVWvSJNWHXN15DWiJABs0IEKyXLVAegCGibAEtYSgKbbsAC0O4AtADNdAa1O3cAe3vYA7vtfwMABNdbFdsRENTO2x3W0D3by4ld11A2wBbXSVfRFd3HliAT3ckWwxYW1N2Uy5bb0sa22L4WxNjJ1slENNEbXUQJTxCUgoaOgYWNi1UAG0QPQNjMwtrO0cXN08fP1sA4NDbcMjo2PjE5NSMrJy8gqaSxDKKqsb6xubWpXbO7t6Afi8ugA5gBeAAqACUAKK2AAMlFsBFhuhRjEgADJINZAiCAEz4iRkXHUAi40gk2hEogADkYJAk1GpRFhsLI1OpIAAugBfVgQGAYXLsNCgYKFQQzYSjMTERjUnl8qDQF48QTAXngJWwQyBVTUXTUWH2QKmBGwgiMAi2MhGki2CmMSrG3S0giQOnUXGIkaiShkOXmkDcoA
.zdnet.com/ Name: utag_main
Value: _sn:1$_ss:0$_st:1574441151591$ses_id:1574439345631%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: s_lv_zdnet
Value: 1574439349547
.zdnet.com/ Name: s_cc
Value: true
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C00754888887602075713342477076251741235%7CMCAAMLH-1575044149%7C6%7CMCAAMB-1575044149%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1574446549s%7CNONE%7CMCAID%7C2EEC04DA85159303-6000085526D27B7A%7CvVersion%7C2.3.0
.zdnet.com/ Name: RT
Value: "sl=1&ss=1574439342450&tt=9154&obo=0&bcn=%2F%2F5f651e6e.akstat.io%2F&sh=1574439351607%3D1%3A0%3A9154&dm=zdnet.com&si=3eda77bc-f064-4a1c-ac41-4627c0d5c16a&ld=1574439351607"
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/ Name: aam_uuid
Value: 00978766688924010673329663983030683979
www.zdnet.com/ Name: XCLGFbrowser
Value: YiZk8V3YCbXLp+ifSic
.zdnet.com/ Name: s_vnum
Value: 1577031349546%26vn%3D1
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
www.zdnet.com/ Name: viewGuid
Value: 69979fa5-eefd-4b55-ab48-c45a8da1cd4d
.zdnet.com/ Name: s_invisit
Value: true
.zdnet.com/ Name: s_getNewRepeat
Value: 1574439349547-New
www.zdnet.com/ Name: LDCLGFbrowser
Value: b6850c4d-3f58-41f6-b56c-a61b43eb5962

61 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service pending (GDPR consent not granted): script_yield_intelligence
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 331)
Message:
Found registered service worker: [object ServiceWorkerRegistration]
console-api log URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 522)
Message:
dom not ready, setting event
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 778)
Message:
ADS: queuing nav-ad-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1250)
Message:
ADS: queuing intromercial-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1292)
Message:
ADS: queuing leader-plus-top-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1482)
Message:
ADS: queuing inpage-video-top-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1492)
Message:
ADS: queuing sharethrough-top-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1661)
Message:
ADS: queuing mpu-plus-top-5dd809afaef07 for display
console-api info URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 316)
Message:
Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1765)
Message:
ADS: queuing dynamic-showcase-top-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1772)
Message:
ADS: queuing mpu-middle-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1981)
Message:
ADS: queuing mpu-bottom-5dd809afaef07 for display
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 1998)
Message:
ADS: queuing leader-plus-bottom-5dd809afaef07 for display
console-api log URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 524)
Message:
dom ready, triggering load
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent finally granted): script_yield_intelligence
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_chartbeat_video
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api error URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E(Line 16)
Message:
ads::trackingCookie::init unable to load url /ad/ad-cookie/69979fa5-eefd-4b55-ab48-c45a8da1cd4d error
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201911202007(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_video
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api warning URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
VideoManager.initialize() did not receive a valid error callback function.
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
UVPJS 0.42.297 02/01/19 10:20:35 AM (PST)
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
[MUX] _initializePlugin
console-api warning URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8)
Message:
mPulse: Custom Timer 'video_ploaded' is not defined
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[17:15:53 GMT+0100 (Central European Standard Time).088] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[17:15:58 GMT+0100 (Central European Standard Time).332] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/this-fake-software-update-tries-to-download-malware-onto-your-pc-even-when-you-click-later/?ftag=TRE-03-10aaa6b&bhid=22255429125791934258675598500488(Line 93)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c844.akstat.io
5f651e6e.akstat.io
686eb51b.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
adservice.google.com
adservice.google.nl
api.viglink.com
api1.lightboxcdn.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsi-adops-fastly.global.ssl.fastly.net
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn-magiclinks.trackonomics.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
l.betrad.com
lightboxapi1.azurewebsites.net
match.adsrvr.org
mb.moatads.com
ml314.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
techrepublicvideo.cbsistatic.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
z.moatads.com
104.17.208.240
151.101.113.181
151.101.114.133
151.101.114.2
151.101.13.194
151.101.14.2
152.199.23.241
172.217.22.34
172.217.23.130
2.18.233.143
2.18.233.201
2.20.171.216
216.58.205.230
23.5.97.37
23.67.136.71
23.99.128.52
2600:9000:2043:2a00:1d:8c8c:47c0:93a1
2600:9000:20eb:6600:18:1fcd:349:ca21
2600:9000:20eb:f800:2:42d9:3100:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4ea5
2606:4700::6810:50a5
2606:4700::6810:a40d
2a00:1288:110:c305::a000
2a00:1450:4001:800::2003
2a00:1450:4001:800::2006
2a00:1450:4001:818::2004
2a00:1450:4001:819::2002
2a00:1450:4001:81a::200a
2a00:1450:4001:81b::200e
2a00:1450:401b:804::2003
2a01:4a0:1338:28::c38a:ff18
2a02:26f0:6c00:181::11a6
2a02:26f0:6c00:184::11a6
2a02:26f0:6c00:19c::11a6
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:1b::444
3.248.124.132
3.93.243.95
34.197.12.217
34.198.36.32
34.224.154.10
34.253.43.81
35.157.160.140
35.177.212.30
35.181.91.36
35.190.38.167
35.190.72.21
35.227.208.151
52.86.197.16
54.154.151.160
54.154.203.64
54.77.205.213
54.93.117.16
63.32.143.173
64.30.230.22
66.117.28.68
66.117.28.86
72.247.225.98
72.247.226.64
95.101.203.206
99.80.15.126
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd
039a6d68ca32558b707e0b3f94ee7260020286866f0d4065acf7dccbf67e1187
03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
048d4d3cbcdd6f4a898814bdf05afc48a024871b4b86c8436c18ca869a6da047
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1
070f3261d7c1c0f61a6a170ba38c87006e629430eb465db16a06c596a67d78b8
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
0960af040ddb11b51e449dca7ab1a7dc21116127b0800c3a00147f719d30ceb7
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0ec3a9908b9659e6153920a69b6f8c50d3e37ad7bac5f171f02e7b6af20b100a
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14a51810046204d009dbe20748db4e2e2d8bd113a7b3942ff1cdca711850d966
14fadfb54f2da8d41bb138858eed71c8fe2bca5e8751ed7bc97a4ef35a9963e0
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
188e42e723cc4177e5e0935d6d1631d12141fc944072dec45545f0e150f2c262
18a1ef1b11c4448f6d4044b61d673785e24e14f7002d253e918bb16a33472b63
1b4e880562089e962c186e8a6c4ed9342a519174d497e8cc1f2a556ea9971d1d
1bd7a7078987d4a536bdb4a5b56faf5099813c2e4ecc8d91cee8c6526ec2f66e
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1eff300c2d90f7744943dfca8270dcddcc7cfe4ea6e4f52c8db039b1efb9c67c
2070e53417e34102b0abc85355224343e118d3bbfc2bd0c90ac9c4ee950be6b3
23f083fdb7a2f1ebb56e166dd8fbd6cf347584a28cbdc198beea5de5da0427b0
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2615b1899dd8b771c641ecd424c2500c8c5ac44bc805e2c6a2f25ff200aa7ef0
272fde029afd83c4ce7ef802994ffbcb31fc563c7c79ddfba6961608afe3aa42
2970ff12e0c4ec8f24948ece12776e77ea682a61b8eeaf699a428bf8c57d5d2b
2a040554837616de71221c4ddd1197009025959fbffe573cbc9ecc1ecd70d8f0
2b4b9fd7115437f7483cecf0e6b4029a0c99b1dead67f025fe28d5b478271dac
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
306c04f0d3d3fb9dad6bf09a45209b064a6a89a310a34ad331125e396df8e040
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
30bbf50cc6d793b443da420f6db23779a2cdb3b903fbcad7c5469aa9ea3eea2e
33a8ae689f5522941bcac56a1fd10c19face4ebde701654152aad7ce81f33554
38432e170d5af203d75d3ac9b044adc593b6d95e53bb56c13e9976ca8437726f
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3a7816292dc688561de01122dae9125040e935ca2ca03059f37844dfeecc0aec
3be3ee8c5293f578f8865ed6e5e7dc65fcb83260ed177fc05bede39605c5c317
3ca7835be88ef09682e1c7e7a150e2b599411124ab102e6f1a475f518fc08ae9
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
423f20ec113842e6edf242a4dc46fabb87284b44f58f4beaa1cd50798657181a
4289d88fd1584fc618b9596e35f29b2def5d0822c6029f40b6380ac9df530e56
46b1556bbc2c6aa113e0c1528889851f259cd58a8ccbd1adee36b0d7d86b7f4e
496e9f805fa2717597682be4551ebce8248658538c9e65809e12398c15f59261
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4da29b1e6e6c2ad36d448d129a924763a0a66b35d94c2a82467090ac1efff358
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
4f9f5996c1ae662b5df931d220f6348ff600f89d54577167d140bf42bb7440c5
50489555526e4d24f0e44c58d75a251cecbb74dfd8445a09d2bac66f3b08f9db
5495fb3589c8d83e90b4ba27cf43e5455479896dcec56e3fdd8e9180b8809c9d
54cb5314730285c5d21ce51925d43fbc6d5e513ae7b7237f822a80f07ba42f33
5598b49a11a77e2ea02ce80db835ddb9efe7e700264c8a84baa7f01718b44601
5773316fb5438402e1b069fafb7354b62db9eb931ce609e60075f7c80335bf02
58ba62d48b5bfb066e6eb1b745e54943de881794c08cf1512f6743fe6fba1e04
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5f094c07888854207f5bcd1fa7b58f95f90006cbaa6c0255ff035396a4542eb0
5fda881273604acb5ae18d290d8d806011e8d3f853fd5ab1161308d3266b1fb0
6095abbb05678ad2420d05f73b4e99041c20411c08afa86511a69a7f4bdb0412
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6
62ce950ad0d7f664b316b4253bbc993bf0bf8310970f64b150fda6f1fa59dfea
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
6444228e71bf757a91c98fa225e5f5ab1474ce4ab2e00f8bb4891f704961d856
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
66fa83d355349ddf9398181109120dc4a3e04edc67ccb80ef1fb7e1289e1722a
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a
6d84befe4164365ab97a8048442cfcec0e3393d4fd2cfbb62c79457dac821f25
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
713a9c8e74072b9615bfe3142203093b8c79d190172518d6d536bd0663b3095a
72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
77e6604b757d3c83419e9b62b6403d57f10c1237d29ec187745e511ae8715ab2
783723282e302e6ef8cf6388500e6f79ba4c2e75ad3d722f29e433ac1957d671
787b34ffd7cd823938ab8b1f40b6651327291f1b00540438e3b291d6882ee360
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
79e1dad0d09d72b636ac0610386cc3dbdcb2e7e0fa4435438fa2299d06737f3e
7b9d20858bc032ebfa55673b03d1329609f8e8ab0e9d8eaece5f42653f6272ad
7d4379db396416fce4c84eb2f30294e0d5836f24d011328a1c1ec2296cbbbfb7
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7effa2e2d6e22b52d6aaaa218ded825e24ab9360db646bcc394965d66c5d0ced
7ff155d8ae26056213d07aecbdce9d7857daa7c30e61acc3f31e9885c17e1d4e
8009003c0031cf9a3750da3c19766334140c0c3d04500b279929d35ca2086905
800ac967629a26ef4750b85947614e3872a82d12c233c67295a2ffa6b24c3c6f
80b14da032f9ce90efcd405e250cf828e376d8a0ad59f307f601ed28c9c27cd5
81a58684a9ef16f6f2ca46a579a71a25bdc28a7cbd913386e14b2dad527c8a3d
82b3db0559aa155e9b36870b6e2913c7b2a94ab9faed6bb8330dc279400bc2f7
82bbafe6f10665c303950cee83918e548ed3048f21062fd2b79d00d67a89bd01
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86b94334465d020bf78104b9ec74702c4df513a0c2c82c0a26a2726b529fe829
87f7ab766f2ca84cf0ab3320e468a9ba39a466fe2cbcb6454b0c76fd36ec4c0b
882b89e91f4bf03dbbc9df96a58cc00f24eb3c5262953e7ed86436485fa3e296
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ea876814a2451547eb13fe4fd0ca9d9f2e07ccec70c7bbc3d4f9a57efe909f2
92a3a79c64f777aa63d0d7ffe31e49c3fb9c15b207257071f482533864d0b43a
93296441bb07b4162bd10108aecc8a1b485019093f269635f630d5f1ea4b6fd8
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
9632fcdf5570ef406de1fc11643c3eed93eadec5527de6a11caf7eb0374a7828
96970fdca8565f34daeea301d8dd4358593100f3857f69b43d563768d0ef6918
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172
9bdb7fa85c0730401229a81e4f9f1d13f6ab6db034b692e8cc1885d361ca218f
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
9e90ab774d8cf2fc4bd0a9683a51df9cdd2fdc9532da65d05731b13c68628b87
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a48d7d86d6a12c3821418fd734d5fcc2e4c4c55454af88b9011afb26beb59ccf
a86c13ba9ecf99da51d6d85da54b38a98ec9d7aaef44f4d0cabeca0d5e7076d5
a993ec522b27fc341edfb94cf3093c78da5349e9d846bd512ff277fc3d33ec18
ab00099de5e245b05e2e4c1fdc735e378b8aefe6ab88d834830dfd61e7e52b4f
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b31c01ae5495438ed2c074d17fe43a7271cdd769896d3a68a801873cc0a50e0d
b9f302a2bc6a98a540d1ae773ad95aa0a6e0da1cd8bb630a1ab628cbcf37d587
bf213a61ac726a18807397bddef7b619adbf149b9538b0cca22ed448d4e85848
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c00d20ad50f9db6e623712551f7487ffb66a9657fd900625b015c03a6b7b5781
c1b70915d4a91c9e458bdc788e6e645492fab55d1a6c11ff72b3653457561441
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d
c4368488f6f4897efe452dbd12a1ceeb2f961ec34163c83bde62eb241df4b68c
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c75fec46013de758112a168bfb4377880b24ceffdca7a59e7fae42f4f126906e
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cc9ddbbc322aaedc11e73f45376ce3b5829f6e88c94e2a7ec8894a46fc5ef7ca
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cdd64e5652c18bfd813e4c6adfd0d2c030bcf0c4730ac94cb6371e79cfc6f7c0
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0248a53ad240633172443f8e29edca4f57239c5911eed449808738817ab3cb4
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d148114905f1f24b1b2d566c8d8d3f510cb616208f0d03e9f3beacd09bc56ff7
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d5eac736c81e1cec5dc26a4a10f45c1e17a5bf4918455845d8602e50f7ae4c2b
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6b973e246a4ddcfc0854d5d5410183c478c186ff1f8531b2265cd94e6c057d5
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d76d014c9502788c02aa428f9b1514cb0710ec140528051ccf256431ba3a069b
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dda8aff432680cbb14ba8036d98178bdc8960a42e1aaee355b46feb65e66e8fb
de1e3453e64a32339148ad1afe4a0f7c30082d7d80c9ad60440585e678fa7030
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e0621ff3644a6732ed62761fcf1d33ad53a1f9fa19c71e7e872e5244fe50793d
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e11ef4f4ac089cf20af14da114f59b6a70567f42bea530db1a59d95d9c04a9b3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e47dab0fc8f606fffed7633ec00e128497015eda58f5b3c152c50cab502ad745
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e55319d6eccb80ea00bca763ab145ac8105ace1e12e8a6c1c25b9612ad32f3a6
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f04010c10191abc17120b2224c754666f8e946a500a22bc20c73aebe141259da
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f209dda944040e3007e7eca9fd1c35c9a64a39c7763cb10c7da611c015ba6d72
f20f83cb7683a1a3138cd52201d83436e33a5e67ef0b9c96bbdab860b5f7da16
f2e30d5b33dd74313b4b7d5cea5417a1183ca3c47b537bdc1c94976b2e6813c5
f41d7a7931045aada7ef8db5efbaff0857f470408229383c5103dfc488708853
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f74bb59fc5aa63497609a7fdba4089c48a5828a2779620a6a660e6c7a66d6d19
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ff452e92c4558e00c55b48159730622cf3f4dea7826a3247a3853e7059add887
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5