urlscan.io logo urlscan.io
SecurityTrails logo

www.theregister.co.uk Open in urlscan Pro
104.18.235.86  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Effective URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Submission: On August 28 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 15 IPs in 5 countries across 14 domains to perform 83 HTTP transactions. The main IP is 104.18.235.86, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.theregister.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 4th 2018. Valid for: a year.
This is the only time www.theregister.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 159.100.131.165 13768 (COGECO-PEER1)
1 23 104.18.235.86 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
7 216.58.207.34 15169 (GOOGLE)
20 2606:4700::68... 13335 (CLOUDFLAR...)
4 2.18.234.190 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 92.122.252.200 16625 (AKAMAI-AS)
1 70.42.32.31 22075 (AS-OUTBRAIN)
1 151.101.114.2 54113 (FASTLY)
11 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
83 15
1    159.100.131.165 (United Kingdom)

ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA)
go.theregister.com
23    104.18.235.86 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.theregister.co.uk
go.theregister.co.uk
1    2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
7    216.58.207.34 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s24-in-f2.1e100.net
securepubads.g.doubleclick.net
20    2606:4700::6810:5351 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nir.regmedia.co.uk
regmedia.co.uk
4    2.18.234.190 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-190.deploy.static.akamaitechnologies.com
widgets.outbrain.com
2    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
adservice.google.com
2    2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
2    2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:818::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    92.122.252.200 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a92-122-252-200.deploy.static.akamaitechnologies.com
tcheck.outbrainimg.com
1    70.42.32.31 (United States)

ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US)
PTR: ny.outbrain.com
log.outbrainimg.com
1    151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
odb.outbrain.com
11    2a00:1450:4001:815::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
tpc.googlesyndication.com
5    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagservices.com
pagead2.googlesyndication.com
Domain Requested by
22 www.theregister.co.uk www.theregister.co.uk
16 regmedia.co.uk www.theregister.co.uk
11 tpc.googlesyndication.com securepubads.g.doubleclick.net
7 securepubads.g.doubleclick.net www.theregister.co.uk
securepubads.g.doubleclick.net
4 www.googletagservices.com securepubads.g.doubleclick.net
4 widgets.outbrain.com www.theregister.co.uk
widgets.outbrain.com
4 nir.regmedia.co.uk www.theregister.co.uk
securepubads.g.doubleclick.net
2 www.google-analytics.com www.theregister.co.uk
2 fonts.gstatic.com www.theregister.co.uk
1 pagead2.googlesyndication.com www.theregister.co.uk
1 go.theregister.co.uk 1 redirects
1 odb.outbrain.com widgets.outbrain.com
1 log.outbrainimg.com widgets.outbrain.com
1 tcheck.outbrainimg.com widgets.outbrain.com
1 www.google.de www.theregister.co.uk
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 fonts.googleapis.com www.theregister.co.uk
1 go.theregister.com 1 redirects
0 mcdp-nydc1.outbrain.com Failed widgets.outbrain.com
0 pj.l.admedo.com Failed www.theregister.co.uk
83 23
Subject Issuer Validity Valid
theregister.co.uk
CloudFlare Inc ECC CA-2		 2018-11-04 -
2019-11-04		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-07-29 -
2019-10-21		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-08-13 -
2019-11-11		 3 months crt.sh
ssl909866.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-05-23 -
2019-11-29		 6 months crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA		 2018-12-14 -
2020-03-14		 a year crt.sh
*.google.com
GTS CA 1O1		 2019-07-29 -
2019-10-27		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-07-29 -
2019-10-27		 3 months crt.sh
www.google.de
GTS CA 1O1		 2019-07-29 -
2019-10-27		 3 months crt.sh
*.outbrainimg.com
DigiCert SHA2 Secure Server CA		 2019-02-24 -
2020-05-25		 a year crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-07-30 -
2020-07-25		 a year crt.sh
tpc.googlesyndication.com
Google Internet Authority G3		 2019-07-29 -
2019-10-21		 3 months crt.sh

This page contains 7 frames:

Primary Page: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Frame ID: CF475EB4AC5BF0B654E60A4EDB079610
Requests: 61 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsum8lMCGNkrdrDX5751xS6jYhlVV3I-RiCS0zzSEEeW74VGn9B4Il9aNO-1VjnVrVuSPfdgbGFHCYIt_NZ_mu_zC7lUiWEMOyxHOODvmaEH3VPb0zlcScID9bSUhkqq969TVVy1k0Qf_H3G43Pts6lrR8Fi_ieRiYv5L7x82q5UTDiCnD7wenzEzW6htskIW298eIVXNiC6WTZmrfRrAzrhxtBBeMNFsxP6wOkFdPbQs8Zy3A48ygmoUtnpjvApcToqB2aSQ3Nl3LNM3KHVH68mC5LaejP7WBfVyaM&sai=AMfl-YTxclo0-8OHkuRrfKS1AzBVHZZIw0nLMiUt5l5LFLrYUViTwHFP1Afp-I5nNqGD41OFi5smvFl8uyp8qTGbDxZWnE0MmcHE7Noi8hGK&sig=Cg0ArKJSzOBeKbst5-iUEAE&adurl=
Frame ID: C83C7CE4276DC1FB1D56E8C86FFDF679
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu59fBN3vAfWY4E-EXpJzgKUL_Ko_vg_qEsHNgibxKMFce34qyJlxSE_1wsG-MjxwVTRuefd5fwyQKAvcx_751p0hPoMKS9GuLP_yeMtzcHAbV4rWg_K78l7_9cr4rGdXN3XhFScQSO5ovjX7Y7705VByzIqaYIdZ1UYa48vYEi-ZFYlF40FItIZELChqmiJNaetSKMQqA1d2X78dMrrIJklHwG-F0JGqnaNA_fa9OmgC1fRlYbkHT_D0gKgFxHaNsreudOgNoUyIzER1ZNf8dROWZd731cgNtGFds&sai=AMfl-YQ6bDPlDyn40SW4IiL2SgKD2uZBcZEBmTb3eE6DHZFtLB3aiVIwzwzZT6lDmg_6i-T9IMX2KKEcfNz1Ldh2Ux-DZgRqQXeqx9G7SIQi&sig=Cg0ArKJSzA0R5hCtaQMMEAE&adurl=
Frame ID: C05E1D0DE39A11AA565622284CA4612E
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: 70E8B2F6BCBB1587850F94E3B8A5743B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: BA7FD81765DFFB8806D88E5516804EC2
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8K9r4lpKLqxXDX9WRM38wBZDrxJHgvAV9cFbFjLBlpOB5RC3Ts99L9bs66li2ZP7tbpUUl3pOfjhf7Qd0zNuTs8k3zcoHTrLeGZmbKpW6YA6cbbSxMXJTxBDhurSO99sR0XODJF9embtQykHx1ohbaJAQs91498Qrqxz1nPzIoQofD_vIKOKIqxIdFQ8lbeo95qQpwGLY50QmxWnc1eaOcTCcsZ0iHn0xFB6d3JIvp8WeIijvnVOHWUbo-Ex1I1jaYXsk75riMLLBtI1Lzl9pH7Bos5LFRfWZ0M4&sai=AMfl-YT0MhLAdZGaAJhu5mBd4ZQN9-q2U7mYxzAEylOw7cS7Kiw2cgGTT4uOVRv5OZmPcVmNvjNHPZ51UbX_h5BPw5Nfb_7S17Jyedyd_jTv&sig=Cg0ArKJSzCIdxDy7wbfgEAE&adurl=
Frame ID: 649DC6560F0B42FB1AD7CFE67D789B69
Requests: 7 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: 813FBEC74544DE7C99237760A708CB0F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Time to spin the wheel of pwnage! This week, malware can infect your…. Android set-top box! • The Register

Page URL History Show full URLs

  1. http://go.theregister.com/feed/www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/ HTTP 302
    https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

83
Requests

96 %
HTTPS

59 %
IPv6

14
Domains

23
Subdomains

15
IPs

5
Countries

752 kB
Transfer

1671 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://go.theregister.com/feed/www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/ HTTP 302
    https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&gjid=703714876&_gid=2085207149.1566992803&_u=YGBAiAABB~&z=140562669 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669&slf_rd=1&random=10821613
Request Chain 79
  • https://go.theregister.co.uk/k/abt_a HTTP 302
  • https://regmedia.co.uk/2007/09/13/tp.gif

83 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Redirect Chain
  • http://go.theregister.com/feed/www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
  • https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
65 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d30dd9423a2fc4bd91525512490fb30f37a714a0883e7c10dc9f07df8200cd1

Request headers

:method
GET
:authority
www.theregister.co.uk
:scheme
https
:path
/2019/08/28/android_set_boxes_ares_malware/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 28 Aug 2019 11:46:42 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d86d0626ff094e1121c616579a236ce0b1566992802; expires=Thu, 27-Aug-20 11:46:42 GMT; path=/; domain=.theregister.co.uk; HttpOnly
cache-control
max-age=0
cf-railgun
ef75ae5d66 4.92 0.051291 0030 57da
expires
Wed, 28 Aug 2019 11:46:42 GMT
vary
Accept-Encoding
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
x-reg-bofh
pfy02
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
50d60bd5c91ddc2f-LHR
content-encoding
br

Redirect headers

Date
Wed, 28 Aug 2019 11:46:42 GMT
Content-Type
text/html; charset=iso-8859-1
Content-Length
340
Connection
keep-alive
Server
Apache/2.4.10 (Debian)
Location
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
X-Reg-BOFH
pfy02
X-Clacks-Overhead
GNU Terry Pratchett, Lester Haines
css
fonts.googleapis.com/ 		5 KB
697 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Arimo:400,700&display=swap
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
337b7526b508f444c0dc7b69afaf6a0697d1becbd0d8305789d96cd850c51b47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 28 Aug 2019 11:46:42 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 28 Aug 2019 11:46:42 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:42 GMT
design.css
www.theregister.co.uk/css_picker/webkit/dc57f0e5111f9f2e4ce5bf069d2b77182e7a72ae/ 		111 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/css_picker/webkit/dc57f0e5111f9f2e4ce5bf069d2b77182e7a72ae/design.css
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eb82d9c40f140d0baddbae6798603dd162f040c5641f450c5916849b5d30597

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Wed, 28 Aug 2019 10:46:37 GMT
server
cloudflare
age
3550
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
50d60bd67b61dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
_.js
www.theregister.co.uk/design_picker/180d9f9fc3e52da6e13d75d1bf80b9d1fd2a9661/javascript/ 		212 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/180d9f9fc3e52da6e13d75d1bf80b9d1fd2a9661/javascript/_.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cee164a802cd4c573942d517048393e035dbd40f7f3bc5829c36d42e289519e8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Tue, 27 Aug 2019 15:42:52 GMT
server
cloudflare
age
72196
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
50d60bd67b63dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
sffe /
Resource Hash
485bf250acef233a906a3026cae439fe87191d6a25c84bfcd4e767b99b442fc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"262 / 262 of 1000 / last-modified: 1566934938"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
12678
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:42 GMT
/
nir.regmedia.co.uk/ 		216 B
932 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.regmedia.co.uk/?g=vk&g=c&g=sa&g=vvfc&s=c/sec.front&s=vk/malware&s=vk/android&s=vk/mirai&s=vvfc/9d3f7db9393c270d4793daa30c3c6099&s=vvfc/9f6d191d16e6e0d9e43121cb49c82794&s=vvfc/273fe2b5a51992a6d339a1a42fb59438
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f0b6183a141ea5e5348f55566ab5f830a4d1a29bc1e09d4eee6e198654b12a7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/x-javascript
status
200
x-reg-bofh
pfy04
cache-control
no-cache
cf-ray
50d60bd6bc66cbc8-VIE
expires
Thu, 01 Jan 1970 00:00:00 GMT
reg_logo.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/ 		21 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/reg_logo.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c8896402bbf07a912806f65abf3a2114da1aec0ad0ac738d75cf04909d17479

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15226867
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd67b64dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
twitter.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		745 B
481 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/twitter.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16254479
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
50d60bd6cc03dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
facebook.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		311 B
278 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/facebook.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
17219975
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
50d60bd6cc18dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
linkedin.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		459 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b8f65546caa8f567c7eb1358bd4bbfe3416ae2449f713ddcf02e3c03f9b16d1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15292808
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd70cf7dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
vulture.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		2 KB
861 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16303637
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
50d60bd71d18dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
search.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/ 		609 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16443398
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
50d60bd74d7bdc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
search_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/ 		576 B
383 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/search_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4b97e761f9ed3ac27a5bf303831fdf534b1c0271a879dff72f9622938d3124a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
4860616
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
50d60bd74d7fdc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
dl.gif
regmedia.co.uk/2016/04/14/ 		35 B
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/04/14/dl.gif
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
17221904
cf-polished
origSize=43, status=webp_bigger
status
200
content-length
35
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 14 Apr 2016 13:41:38 GMT
server
cloudflare
etag
"2b-530720dc4f2ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dc3cbc8-VIE
cf-bgj
imgq:85
search.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 		609 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
1144154
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd74d82dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
rect_comment_bubble_black.svg
www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/ 		645 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_black.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e9e84a5ab41d6420c9da8bf21a234c69ea9bd97d020430a5dd028e4f3ff4c18

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Tue, 19 Dec 2017 16:33:56 GMT
server
cloudflare
age
16238640
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
50d60bd74d83dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
reddit.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		1 KB
648 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/reddit.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16361099
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd74d84dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
linkedin_alt.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		363 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_alt.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16368746
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
50d60bd74d86dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
shutterstock_fortune_wheel.jpg
regmedia.co.uk/2019/03/21/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/03/21/shutterstock_fortune_wheel.jpg?x=442&y=293&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
413977e48a363220c4c8145b9d719ab0b1db81aa5d5ad20d2d7537013ed5e96f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
1419
cf-polished
qual=85, origFmt=jpeg, origSize=22816
status
200
content-disposition
inline; filename="shutterstock_fortune_wheel.webp"
content-length
21798
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 21 Mar 2019 17:51:54 GMT
server
cloudflare
etag
"5920-5849e64ccd1ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dbfcbc8-VIE
cf-bgj
imgq:85
shutterstock-bulldozer.jpg
regmedia.co.uk/2019/08/27/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/08/27/shutterstock-bulldozer.jpg?x=88&y=58&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1afc077906e0a565bba564ce002936efd683c26eba60e69ea97d7f0005472520

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
30501
cf-polished
degrade=85, origSize=2405, status=webp_bigger
status
200
content-length
2404
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 27 Aug 2019 19:00:15 GMT
server
cloudflare
etag
"965-5911de20708d5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy01
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dc2cbc8-VIE
cf-bgj
imgq:85
shutterstock_worn_out_shoes.jpg
regmedia.co.uk/2019/08/26/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/08/26/shutterstock_worn_out_shoes.jpg?x=88&y=58&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
774d617bda63a971889ef9d31f4a041fc9492cdd2cfff41dfd9992f3785cdc9d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
81214
cf-polished
qual=85, origFmt=jpeg, origSize=1691
status
200
content-disposition
inline; filename="shutterstock_worn_out_shoes.webp"
content-length
1598
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 27 Aug 2019 13:12:09 GMT
server
cloudflare
etag
"69b-59119051b387a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy01
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dc1cbc8-VIE
cf-bgj
imgq:85
neptune.jpg
regmedia.co.uk/2019/08/24/ 		582 B
754 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/08/24/neptune.jpg?x=88&y=58&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
48e218b49ac260c64e5c3cd69f7e4c5122ff9a77e3a71646ec23400c58f7850e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
36129
cf-polished
qual=85, origFmt=jpeg, origSize=1023
status
200
content-disposition
inline; filename="neptune.webp"
content-length
582
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 28 Aug 2019 01:12:10 GMT
server
cloudflare
etag
"3ff-59123140fef71"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy03
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dc0cbc8-VIE
cf-bgj
imgq:85
trump_shutterstock.jpg
regmedia.co.uk/2017/09/28/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/09/28/trump_shutterstock.jpg?x=88&y=58&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
247d70ec0ab88fdf7c489af502388ca202a477bce657b8e00d8e41aae0a8211d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
102766
cf-polished
qual=85, origFmt=jpeg, origSize=1382
status
200
content-disposition
inline; filename="trump_shutterstock.webp"
content-length
1300
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Mon, 26 Aug 2019 22:25:55 GMT
server
cloudflare
etag
"566-5910ca3b750f6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd75dbccbc8-VIE
cf-bgj
imgq:85
shutterstock_286531337-tube.jpg
regmedia.co.uk/2015/07/07/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2015/07/07/shutterstock_286531337-tube.jpg?x=88&y=58&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc0a21fef5e9de80ffb40de0e8e1abb5ee07df8add5d4701da04dd5b2a947cd4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
12741
cf-polished
degrade=85, origSize=2682, status=webp_bigger
status
200
content-length
2675
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 27 Aug 2019 08:16:05 GMT
server
cloudflare
etag
"a7a-59114e247e3df"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy03
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e35cbc8-VIE
cf-bgj
imgq:85
outbrain.js
widgets.outbrain.com/ 		103 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.outbrain.com/outbrain.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7fb814cb1e0545a25c9f4bdc9ada88da44ae089ae8c9adfea25c02e725234c1b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 28 Aug 2019 11:46:42 GMT
Content-Encoding
gzip
Last-Modified
Mon, 19 Aug 2019 06:05:11 GMT
Server
Apache
ETag
"391a08a23c47387b9d1db97e395d88a5:1566194711"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=14400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
35685
whitepaper_book.png
www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
17567436
cf-ray
50d60bd74d87dc2f-LHR
status
200
content-length
1119
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 17 Feb 2017 15:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03
expires
Mon, 21 Sep 2020 11:46:42 GMT
android_logo.jpg
regmedia.co.uk/2016/09/20/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/09/20/android_logo.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b630ad624ae9d9244f06b3a6312c919919d9472ded2e06885432b986289c72

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
782694
cf-polished
qual=85, origFmt=jpeg, origSize=6195
status
200
content-disposition
inline; filename="android_logo.webp"
content-length
3474
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 11 Jun 2019 06:03:18 GMT
server
cloudflare
etag
"1833-58b060da39c42"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e3acbc8-VIE
cf-bgj
imgq:85
aws.jpg
regmedia.co.uk/2015/04/10/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2015/04/10/aws.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b599580e039518368c577e2dad9fef97d2ace48544b6be54f041540937495bf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
21251
cf-polished
qual=85, origFmt=jpeg, origSize=9275
status
200
content-disposition
inline; filename="aws.webp"
content-length
7602
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 05 Feb 2019 02:04:00 GMT
server
cloudflare
etag
"243b-5811c05ce6483"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy02
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e3ccbc8-VIE
cf-bgj
imgq:85
shutterstock_ill_android.jpg
regmedia.co.uk/2019/01/09/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/01/09/shutterstock_ill_android.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f050ff666efc1e212f08290a3996c1d66e0e7d9550bc8d10b6c36071b796c16c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
7217588
status
200
content-length
3838
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 17 Apr 2019 14:21:17 GMT
server
cloudflare
etag
"efe-586ba994aaffd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e3dcbc8-VIE
expires
Mon, 21 Sep 2020 11:46:42 GMT
broken_fibre_optic.jpg
regmedia.co.uk/2019/07/02/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/07/02/broken_fibre_optic.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
538f06fc9a023cdc540c6500319733b5e983ec773b02a22e1f70e821ea7ad959

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
845
cf-polished
status=not_needed
status
200
content-length
5642
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sat, 03 Aug 2019 18:07:12 GMT
server
cloudflare
etag
"160a-58f3a581a5b62"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy01
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e41cbc8-VIE
cf-bgj
imgq:85
shuttertock_glum_kid.jpg
regmedia.co.uk/2017/05/04/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/05/04/shuttertock_glum_kid.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0f84da47d72c369868b8e3af574a3595ef268ae99d3353f694e6d00d2c1167

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
613902
cf-polished
qual=85, origFmt=jpeg, origSize=5828
status
200
content-disposition
inline; filename="shuttertock_glum_kid.webp"
content-length
5350
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sat, 03 Aug 2019 18:12:09 GMT
server
cloudflare
etag
"16c4-58f3a69d2823b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd78e42cbc8-VIE
cf-bgj
imgq:85
command_line_shutterstock.jpg
regmedia.co.uk/2016/08/08/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/08/08/command_line_shutterstock.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9364216b1e2cd1f78bb9881a5d360dacefc3516fc345b6d9ef65274b5ed5a9f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
531578
cf-polished
qual=85, origFmt=jpeg, origSize=3980
status
200
content-disposition
inline; filename="command_line_shutterstock.webp"
content-length
3144
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 30 Mar 2018 22:28:42 GMT
server
cloudflare
etag
"f8c-568a8c335aef2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy03
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd7aebecbc8-VIE
cf-bgj
imgq:85
shutterstock_android_malware.jpg
regmedia.co.uk/2019/08/27/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2019/08/27/shutterstock_android_malware.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
50feb77bcb27d97af6fd667041da94b56628ec866750785cd91e44117ef5f695

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
19191
cf-polished
degrade=85, origSize=12304, status=webp_bigger
status
200
content-length
11484
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 28 Aug 2019 05:38:43 GMT
server
cloudflare
etag
"3010-59126cd589fe7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy01
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd7aec1cbc8-VIE
cf-bgj
imgq:85
trojan_horse.jpg
regmedia.co.uk/2016/10/11/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/10/11/trojan_horse.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fda2122ce926e320bfeba9242ac6add42333255ba0348b9a472352cbdb42a0e6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
3809653
cf-polished
origSize=9947, status=webp_bigger
status
200
content-length
9594
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sun, 14 Oct 2018 07:45:58 GMT
server
cloudflare
etag
"26db-5782b82e9d431"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy01
expires
Mon, 21 Sep 2020 11:46:42 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bd7aec3cbc8-VIE
cf-bgj
imgq:85
footer_mob_nav_arrow_black.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		331 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_black.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
4864494
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
50d60bd74d8bdc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
sitpub_footer.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/sitpub_footer.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16224285
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd74d8cdc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
footer_mob_nav_arrow_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		328 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16258453
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
50d60bd74d8ddc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
linkedin_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		371 B
285 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
4864494
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
50d60bd77df0dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
rss.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		400 B
311 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/rss.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
4869148
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
50d60bd77df1dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019082201.js
securepubads.g.doubleclick.net/gpt/ 		158 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082201.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
sffe /
Resource Hash
f8e8baebac4f64ee22208b08a36fa7bb4996b541e95b03f978e7318bf2c8b362
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Aug 2019 13:08:19 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
59542
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:42 GMT
P5sMzZCDf9_T_10ZxCFuj5-v.woff2
fonts.gstatic.com/s/arimo/v13/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/arimo/v13/P5sMzZCDf9_T_10ZxCFuj5-v.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7d79596300bbb0d5208efbeb996a0dd57030fb5bed5f8d1ec3e909054c41ec72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Arimo:400,700&display=swap
Origin
https://www.theregister.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 23 Aug 2019 03:21:14 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:20:03 GMT
server
sffe
age
462328
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
9604
x-xss-protection
0
expires
Sat, 22 Aug 2020 03:21:14 GMT
envelope.svg
www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/ 		454 B
342 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
16870556
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
50d60bd77df3dc2f-LHR
expires
Mon, 21 Sep 2020 11:46:42 GMT
P5sBzZCDf9_T_1Wi4TRDrZKF09E3.woff2
fonts.gstatic.com/s/arimo/v13/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/arimo/v13/P5sBzZCDf9_T_1Wi4TRDrZKF09E3.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b1fd7ed49a8246ec384c86e59d428c8ab8bbcbb247eaa0f8866d92f47ce7b6f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Arimo:400,700&display=swap
Origin
https://www.theregister.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 22 Aug 2019 15:59:24 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:21:52 GMT
server
sffe
age
503238
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
9572
x-xss-protection
0
expires
Fri, 21 Aug 2020 15:59:24 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
3788
date
Wed, 28 Aug 2019 10:43:34 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17803
expires
Wed, 28 Aug 2019 12:43:34 GMT
admtracker.lib.min.js
pj.l.admedo.com/ 		0
0
collect
www.google-analytics.com/ 		35 B
99 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=1614395445&t=pageview&_s=1&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2019%2F08%2F28%2Fandroid_set_boxes_ares_malware%2F&ul=en-us&de=UTF-8&dt=Time%20to%20spin%20the%20wheel%20of%20pwnage!%20This%20week%2C%20malware%20can%20infect%20your%E2%80%A6.%20Android%20set-top%20box!%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGBAiAABB~&jid=1474774918&gjid=703714876&cid=111487430.1566992803&tid=UA-33330076-1&_gid=2085207149.1566992803&cd2=Shaun%20Nichols&cd3=&cd4=www%20story&cd5=news&cd8=none&z=982589353
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Aug 2019 00:03:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
560605
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&gjid=703714876&_gid=2085207149.1566992803&_u=YGBAiAABB~&z=140562669
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669&slf_rd=1&random=10821613
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669&slf_rd=1&random=10821613
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:42 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:42 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=111487430.1566992803&jid=1474774918&_v=j79&z=140562669&slf_rd=1&random=10821613
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads.js
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 		27 B
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/180d9f9fc3e52da6e13d75d1bf80b9d1fd2a9661/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
cf-cache-status
HIT
age
16358076
cf-ray
50d60bd8787bdc2f-LHR
status
200
content-length
27
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 05 Apr 2018 12:48:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:42 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		95 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2895873332462402&correlator=3988497171077448&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21064366&vrg=2019082201&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190828&iu_parts=6978%2Creg_security%2Cfront&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C970x91%7C970x90%7C970x250%7C970x251%7C728x90%7C728x91%7C468x60%7C468x61%2C970x250%7C970x90%7C728x90%7C468x60%2C300x1050%7C300x600%7C300x250%7C300x252%2C300x601%7C300x250%7C300x251%7C300x100%7C300x50%2C300x250%7C300x1%7C300x50&ists=32&prev_scp=pos%3Dtop%26raptor%3Dkite%26unitnum%3D1%7Cpos%3Dtop%26raptor%3Dcondor%26unitnum%3D2%7Cpos%3Dbtm%26raptor%3Dhawk%26unitnum%3D3%7Cpos%3Dtop%26raptor%3Deagle%26unitnum%3D4%7Cpos%3Dmid%26raptor%3Dfalcon%26unitnum%3D5%7Cpos%3Dbtm%26raptor%3Dowl%26unitnum%3D6&cust_params=test%3D0%26protocol%3Dhttps%253A%26li%3Dnull%26uid%3Dnull%26sc%3D1%26bwidth%3D15%26mm_segments%3D%26pid%3D204547%26pt%3Da%26axc%3Dnull%26kw%3Dmalware%252Candroid%252Cmirai%26cat%3Dnews%26tag%3Dnull%26author%3DShaun%252520Nichols%26year%3D2019%26nsfw%3Dnull%26vid%3Dnull%26ar%3Dfalse%26ct%3Ds-async%26vc%3Dsec.front%26sa%3D%26vk%3Dandroid%252Cmirai%252Cmalware&cookie_enabled=1&bc=31&abxe=1&lmt=1566992802&dt=1566992802630&dlt=1566992802289&idt=317&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C308%2C293%2C978%2C978%2C785&adys=-12245933%2C150%2C2604%2C255%2C1922%2C3947&adks=1331772189%2C284626583%2C1390360203%2C2610646818%2C8582313%2C3059020159&ucis=1%7C2%7C3%7C4%7C5%7C6&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2019%2F08%2F28%2Fandroid_set_boxes_ares_malware%2F&dssz=24&icsg=58016&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x4535%7C1000x4535%7C1000x279%7C315x2288%7C315x2288%7C924x1343&msz=1x1%7C1000x105%7C1000x278%7C300x1050%7C300x601%7C452x250&blev=1&bisch=1&ga_vid=111487430.1566992803&ga_sid=1566992803&ga_hid=1614395445&fws=132%2C4%2C4%2C4%2C4%2C4&ohw=1000%2C1000%2C1000%2C1000%2C1000%2C1000
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
507bacd01b816361feb7cdb8faf9bfbf648670961b780e7817406c86bcea6bd4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
16009
x-xss-protection
0
google-lineitem-id
-2,5149927325,5149927325,5116099148,5115367896,5149394068
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,138284794833,138285201169,138275500058,138275474043,138284786721
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theregister.co.uk
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019082201.js
securepubads.g.doubleclick.net/gpt/ 		66 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
sffe /
Resource Hash
ccbea8a338b25c0159e3a49102ab661a444cb412c152da0744c52584b2e43a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Aug 2019 13:08:19 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
25400
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:42 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 		0
0
d3d3LnRoZXJlZ2lzdGVyLmNvLnVr
tcheck.outbrainimg.com/tcheck/check/ 		15 B
475 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tcheck.outbrainimg.com/tcheck/check/d3d3LnRoZXJlZ2lzdGVyLmNvLnVr
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.122.252.200 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a92-122-252-200.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
ETag
W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age
43200
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=13054
Date
Wed, 28 Aug 2019 11:46:43 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
false
Content-Length
15
Expires
Wed, 28 Aug 2019 15:24:17 GMT
dwce_cheq_events
log.outbrainimg.com/loggerServices/ 		4 B
344 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1566992802900&sessionId=c74e9a54-d066-902e-940e-f24ce3675643&url=www.theregister.co.uk&cheqSource=1&cheqEvent=0&exitReason=2
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 28 Aug 2019 11:46:44 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
X-TraceId
b9773b87a2db9c2cfb8e682360a65d1e
Content-Length
4
Expires
0
get
odb.outbrain.com/utils/ 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.theregister.co.uk%2F2019%2F08%2F28%2Fandroid_set_boxes_ares_malware%2F&srcUrl=https%3A%2F%2Fwww.theregister.co.uk%2Fheadlines.atom&settings=true&recs=true&widgetJSId=GS_1&key=NANOWDGT01&idx=0&version=01021008&apv=false&sig=E7qN1NPw&format=html&rand=16802&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=0&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
38553c84b9e4ccad02076f8526c0e05b831f5bcfab7a3fac178b74d8a39b902c
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, HHN, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
c0528ee87155ab85ba57a5cd46f812c0
content-length
13073
x-served-by
cache-jfk8123-JFK, cache-hhn4030-HHN
pragma
no-cache
x-timer
S1566992804.133495,VS0,VE160
date
Wed, 28 Aug 2019 11:46:44 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.23
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C83C 		0
279 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsum8lMCGNkrdrDX5751xS6jYhlVV3I-RiCS0zzSEEeW74VGn9B4Il9aNO-1VjnVrVuSPfdgbGFHCYIt_NZ_mu_zC7lUiWEMOyxHOODvmaEH3VPb0zlcScID9bSUhkqq969TVVy1k0Qf_H3G43Pts6lrR8Fi_ieRiYv5L7x82q5UTDiCnD7wenzEzW6htskIW298eIVXNiC6WTZmrfRrAzrhxtBBeMNFsxP6wOkFdPbQs8Zy3A48ygmoUtnpjvApcToqB2aSQ3Nl3LNM3KHVH68mC5LaejP7WBfVyaM&sai=AMfl-YTxclo0-8OHkuRrfKS1AzBVHZZIw0nLMiUt5l5LFLrYUViTwHFP1Afp-I5nNqGD41OFi5smvFl8uyp8qTGbDxZWnE0MmcHE7Noi8hGK&sig=Cg0ArKJSzOBeKbst5-iUEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 28 Aug 2019 11:46:43 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
abg_lite.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/ Frame C83C 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/abg_lite.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d3b7f78941a8927448bb7ea1ab5f10edadb8e4a8e0f2e2e9c47087a9b5c16d76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11337
x-xss-protection
0
server
cafe
etag
12805878629148866237
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
window_focus.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/ Frame C83C 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/window_focus.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
6dd7e7ea596e944778e78ccd97a2e17837ef633d69cad2108842d4ddcb958b1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
1054
x-xss-protection
0
server
cafe
etag
18205873578609640656
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C83C 		75 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d726fe9c929df177ce82c1bb81e6f4483f60dec0d68226bc3d5662a10570eef1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1566818030648843"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
28571
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
/
nir.regmedia.co.uk/ Frame C83C 		0
315 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.regmedia.co.uk/?s=sa/oid.2424853138
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:43 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/x-javascript
status
200
x-reg-bofh
pfy01
cache-control
no-cache
accept-ranges
bytes
cf-ray
50d60bdc0a0ccbc8-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
6519748715034277319
tpc.googlesyndication.com/simgad/ Frame C83C 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/6519748715034277319
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
83d1830dba8ae02c13124822f990ff7a891b8e4e7f9f60318aeb4ee6789429dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 00:53:06 GMT
x-content-type-options
nosniff
age
212017
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
61351
x-xss-protection
0
last-modified
Mon, 19 Aug 2019 15:49:09 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 25 Aug 2020 00:53:06 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		75 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
eb815c0a9dc0c022eebbaab88f1413f0ab1a49013a63b901ac6483fdd1dc3fcd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1566818030648843"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
28402
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C05E 		0
255 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu59fBN3vAfWY4E-EXpJzgKUL_Ko_vg_qEsHNgibxKMFce34qyJlxSE_1wsG-MjxwVTRuefd5fwyQKAvcx_751p0hPoMKS9GuLP_yeMtzcHAbV4rWg_K78l7_9cr4rGdXN3XhFScQSO5ovjX7Y7705VByzIqaYIdZ1UYa48vYEi-ZFYlF40FItIZELChqmiJNaetSKMQqA1d2X78dMrrIJklHwG-F0JGqnaNA_fa9OmgC1fRlYbkHT_D0gKgFxHaNsreudOgNoUyIzER1ZNf8dROWZd731cgNtGFds&sai=AMfl-YQ6bDPlDyn40SW4IiL2SgKD2uZBcZEBmTb3eE6DHZFtLB3aiVIwzwzZT6lDmg_6i-T9IMX2KKEcfNz1Ldh2Ux-DZgRqQXeqx9G7SIQi&sig=Cg0ArKJSzA0R5hCtaQMMEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 28 Aug 2019 11:46:43 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
6519748715034277319
tpc.googlesyndication.com/simgad/ Frame C05E 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/6519748715034277319
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
83d1830dba8ae02c13124822f990ff7a891b8e4e7f9f60318aeb4ee6789429dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 00:53:06 GMT
x-content-type-options
nosniff
age
212017
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
61351
x-xss-protection
0
last-modified
Mon, 19 Aug 2019 15:49:09 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 25 Aug 2020 00:53:06 GMT
abg_lite.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/ Frame C05E 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/abg_lite.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d3b7f78941a8927448bb7ea1ab5f10edadb8e4a8e0f2e2e9c47087a9b5c16d76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11337
x-xss-protection
0
server
cafe
etag
12805878629148866237
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
window_focus.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/ Frame C05E 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/window_focus.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
6dd7e7ea596e944778e78ccd97a2e17837ef633d69cad2108842d4ddcb958b1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
1054
x-xss-protection
0
server
cafe
etag
18205873578609640656
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C05E 		75 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d726fe9c929df177ce82c1bb81e6f4483f60dec0d68226bc3d5662a10570eef1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1566818030648843"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
28571
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
/
nir.regmedia.co.uk/ Frame C05E 		0
45 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.regmedia.co.uk/?s=sa/oid.2424853138
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:43 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/x-javascript
status
200
x-reg-bofh
pfy04
cache-control
no-cache
cf-ray
50d60bdc2a2ccbc8-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 70E8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Wed, 28 Aug 2019 11:15:17 GMT
expires
Thu, 27 Aug 2020 11:15:17 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1886
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame BA7F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Wed, 28 Aug 2019 11:15:17 GMT
expires
Thu, 27 Aug 2020 11:15:17 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1886
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
view
securepubads.g.doubleclick.net/pcs/ Frame 649D 		0
245 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8K9r4lpKLqxXDX9WRM38wBZDrxJHgvAV9cFbFjLBlpOB5RC3Ts99L9bs66li2ZP7tbpUUl3pOfjhf7Qd0zNuTs8k3zcoHTrLeGZmbKpW6YA6cbbSxMXJTxBDhurSO99sR0XODJF9embtQykHx1ohbaJAQs91498Qrqxz1nPzIoQofD_vIKOKIqxIdFQ8lbeo95qQpwGLY50QmxWnc1eaOcTCcsZ0iHn0xFB6d3JIvp8WeIijvnVOHWUbo-Ex1I1jaYXsk75riMLLBtI1Lzl9pH7Bos5LFRfWZ0M4&sai=AMfl-YT0MhLAdZGaAJhu5mBd4ZQN9-q2U7mYxzAEylOw7cS7Kiw2cgGTT4uOVRv5OZmPcVmNvjNHPZ51UbX_h5BPw5Nfb_7S17Jyedyd_jTv&sig=Cg0ArKJSzCIdxDy7wbfgEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 28 Aug 2019 11:46:43 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
abg_lite.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/ Frame 649D 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/abg_lite.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d3b7f78941a8927448bb7ea1ab5f10edadb8e4a8e0f2e2e9c47087a9b5c16d76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11337
x-xss-protection
0
server
cafe
etag
12805878629148866237
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
window_focus.js
tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/ Frame 649D 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190826/r20110914/client/window_focus.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
6dd7e7ea596e944778e78ccd97a2e17837ef633d69cad2108842d4ddcb958b1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 23:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
129818
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
1054
x-xss-protection
0
server
cafe
etag
18205873578609640656
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 09 Sep 2019 23:43:05 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 649D 		75 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d726fe9c929df177ce82c1bb81e6f4483f60dec0d68226bc3d5662a10570eef1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1566818030648843"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
28571
x-xss-protection
0
expires
Wed, 28 Aug 2019 11:46:43 GMT
/
nir.regmedia.co.uk/ Frame 649D 		0
40 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.regmedia.co.uk/?s=sa/oid.2424853138
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:43 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/x-javascript
status
200
x-reg-bofh
pfy01
cache-control
no-cache
accept-ranges
bytes
cf-ray
50d60bdc5aadcbc8-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
10452950092389536008
tpc.googlesyndication.com/simgad/ Frame 649D 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/10452950092389536008
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5c9458830d50902958e42fbfcda039adefff95c0a87fbdeec49081189794c6a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 11:30:33 GMT
x-content-type-options
nosniff
age
173770
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
81781
x-xss-protection
0
last-modified
Mon, 19 Aug 2019 14:51:42 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 25 Aug 2020 11:30:33 GMT
truncated
/ Frame C83C 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
738fd9d2b01286a8638545cf324a7847811e1e183f2b2586b99d2360e562023f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame C05E 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bec883a0d4e03df40770bcb192bf4738fb62cfdfb27d7b0f43a8a24255c5dc64

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 649D 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c6a829f58a8fe8b598408dcd169bb42d30ec6b0c4e9508408074a40d5c393c66

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
tp.gif
regmedia.co.uk/2007/09/13/
Redirect Chain
  • https://go.theregister.co.uk/k/abt_a
  • https://regmedia.co.uk/2007/09/13/tp.gif
34 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2007/09/13/tp.gif
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 28 Aug 2019 11:46:43 GMT
cf-cache-status
HIT
age
1865789
cf-polished
origFmt=gif, origSize=49
status
200
content-disposition
inline; filename="tp.webp"
content-length
34
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 13 Sep 2007 11:17:03 GMT
server
cloudflare
etag
"31-43a027a4c29c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
x-reg-bofh
pfy04
expires
Mon, 21 Sep 2020 11:46:43 GMT
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
50d60bdf8b23cbc8-VIE
cf-bgj
imgq:85

Redirect headers

date
Wed, 28 Aug 2019 11:46:43 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
302
content-type
text/html; charset=iso-8859-1
location
https://regmedia.co.uk/2007/09/13/tp.gif
x-reg-bofh
pfy02
cf-ray
50d60bdf3939dc2f-LHR
content-length
310
cf-railgun
6edf87097d stream 0.000000 0200 57da
ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 28 Aug 2019 11:46:44 GMT
Last-Modified
Sun, 18 Aug 2019 14:31:30 GMT
Server
Apache
ETag
"c52b07e749f7a09fa7b97b7e195e06ce:1566138690"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
2326
achoice.svg
widgets.outbrain.com/images/widgetIcons/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 28 Aug 2019 11:46:44 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Aug 2019 14:31:24 GMT
Server
Apache
ETag
"9d26fa4e7238ed94f1d0d92afb453b3e:1566138685"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1368
l
mcdp-nydc1.outbrain.com/ 		0
0
Cookie set obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame 813F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Accept-Encoding
gzip, deflate, br
Cookie
recs_4425329ba276bfcaafa471d301397139=0B2296304009A2220876013A2160104771A2328527719A2318014826A2315216024A2168792914A2128788501ACD1; obuid=2c5284e4-522c-438f-a13a-63120ac2451e
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/

Response headers

Server
Apache
ETag
"acece0f0b3969cc3352833e939d8244b:1566393136"
Last-Modified
Wed, 21 Aug 2019 13:10:09 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=604800
Date
Wed, 28 Aug 2019 11:46:44 GMT
Content-Length
3661
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
Set-Cookie
akacd_widgets_routing=3744445603~rv=7~id=e08ff4b29cdc8c8b790a1c30aa4f1822; path=/;
activeview
pagead2.googlesyndication.com/pcs/ Frame C83C 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuYZQ-x5np_qV5bwM5uJyxK262NOPdAeFKZs91Qta5zOKtDIgpq7xI4AmeDTUKy65f55LLrKG8g5SnUbBS0RAIk5N7kXENVgWO-KFaXmIk&sig=Cg0ArKJSzE3kg8e3MpQnEAE&adk=284626583&tt=-1&bs=1585%2C1200&mtos=1048,1048,1048,1048,1048&tos=1048,0,0,0,0&p=150,428.5,240,1156.5&mcvt=1048&rs=3&ht=0&tfs=118&tls=1166&mc=1&lte=1&bas=0&bac=0&met=0&avms=nio&niot_obs=14&niot_cbk=72&md=2&rst=1566992803202&rpt=154&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C4565&ss=1600%2C1200&pt=-1&bin=1&deb=1-5-5-12-13-18-63-11-0-0-0&tvt=1158&r=v&id=osdim&vs=4&uc=13&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=728x90&itpl=3&v=20190826
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Aug 2019 11:46:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pj.l.admedo.com
URL
https://pj.l.admedo.com/admtracker.lib.min.js
Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Domain
mcdp-nydc1.outbrain.com
URL
https://mcdp-nydc1.outbrain.com/l?token=df53e0e66f4e71d921e090157c8ab316_28775_1566992804240&tm=1661&eT=0&wRV=01021008&pVis=1&lsd=2c5284e4-522c-438f-a13a-63120ac2451e&eIdx=&cheq=0&ab=0&wl=0

Verdicts & Comments Add Verdict or Comment

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| RegZoot object| RegCC object| RegVFC string| RegPageType string| RegTruePageType object| RegArticle function| sprintf object| RegUtils boolean| is_rows_based_page function| ads_states_tracking function| bird_alternative function| init_gpt function| ad_free function| show_article_signup_ml function| RegTLRotate function| load_media_player function| pivot_shuffle function| pivot_around function| display_social_popup function| regtld function| getElementCss function| setElementCss function| getElementHeight function| moveElement function| account_form_check function| need_account_refresh function| log_account_refresh_response function| get_epoch function| rolling_time function| time_calc function| get_url_param function| reg_nl_form function| scale_article_inner_elems function| toggle_account_tab_state function| resize_img_url function| send_to_analytics function| NO_DEV_COOKIE function| isScrolledIntoView function| check_rhs_sticky_ads_general_conditions function| rhs_sticky_ad_mu1_spot function| isIE function| spawn_and_load_img_from_div undefined| sticky_ad_RT_2F function| rhs_sticky_ad_btn_spot function| augment_promo_unit function| social_button_share function| sticky_nav_bar function| nav_bar_search function| nav_popup function| scroll_ad function| article_body_safe_spots_for_ads object| rat_ function| track_bucket_user function| performance_stats function| send_performance_stats number| RegPerformanceStatsPerMille function| row_based_page_analytics function| home_page_analytics function| article_page_analytics function| rhs_page_analytics function| prevent_mult_form_submissions function| setup_forum_sort_order function| setup_forum_stars function| setup_post_icons function| forum_icon_selected function| anon_icons function| resize_long_content function| minimise_long_content function| maximise_long_content function| toggle_resize_content function| setup_forum_icons function| edit_post_timer function| setup_forum_votes function| RegSponsorship function| RegSponsorshipChan function| RegParallax function| HideRegBotBanner function| RegBottomBanner function| polling function| polling_setup function| poll_view_results function| render_thanks function| equalize_poll_vote_count_width function| render_poll function| append_view_btns function| poll_view_btn function| render_poll_question function| render_poll_result function| get_poll_votes function| update_poll_votes function| move_poll_question function| submit_poll_votes number| vplayer_count function| slideshow function| slideshow_setup function| load_slide_rail function| load_slide_img function| load_slide_image function| slide_img_v_alignment function| load_slide_video function| slideshow_user_events function| get_slideshow_id function| get_slide_index function| slide_change_request function| change_slide function| change_rail_images function| rail_size function| slideshow_pos function| set_slideshow_video_size function| slide_arrow function| full_youtube_url function| youtube_thumb_img function| $ function| jQuery object| googletag object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| VVFCs object| VVCCs object| SAs object| VCs object| VKs string| Reg__adct object| RegWpTl function| login_state function| is_article2article undefined| page_has_url_params string| GoogleAnalyticsObject function| ga object| adm object| sticky_nav object| jQuery111208662247836665864 number| RegEditWindowMins object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| google_measure_js_timing string| RegSection object| admCustomData string| sc string| axc boolean| google_noFetch number| __google_ad_urls_id number| google_unique_id object| google_reactive_ads_global_state boolean| RegAdBlocking object| OBR string| OB_releaseVer function| OBR$ object| outbrain object| outbrain_rater function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| RegAdsRendered function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
fonts.googleapis.com
fonts.gstatic.com
go.theregister.co.uk
go.theregister.com
log.outbrainimg.com
mcdp-nydc1.outbrain.com
nir.regmedia.co.uk
odb.outbrain.com
pagead2.googlesyndication.com
pj.l.admedo.com
regmedia.co.uk
securepubads.g.doubleclick.net
stats.g.doubleclick.net
tcheck.outbrainimg.com
tpc.googlesyndication.com
widgets.outbrain.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.theregister.co.uk
mcdp-nydc1.outbrain.com
pj.l.admedo.com
tpc.googlesyndication.com
104.18.235.86
151.101.114.2
159.100.131.165
2.18.234.190
216.58.207.34
2606:4700::6810:5351
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:815::2001
2a00:1450:4001:816::2003
2a00:1450:4001:818::2004
2a00:1450:4001:81a::200e
2a00:1450:4001:81d::2003
2a00:1450:4001:81f::200a
2a00:1450:400c:c00::9c
70.42.32.31
92.122.252.200
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
1afc077906e0a565bba564ce002936efd683c26eba60e69ea97d7f0005472520
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211
1e9e84a5ab41d6420c9da8bf21a234c69ea9bd97d020430a5dd028e4f3ff4c18
247d70ec0ab88fdf7c489af502388ca202a477bce657b8e00d8e41aae0a8211d
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15
2eb82d9c40f140d0baddbae6798603dd162f040c5641f450c5916849b5d30597
337b7526b508f444c0dc7b69afaf6a0697d1becbd0d8305789d96cd850c51b47
38553c84b9e4ccad02076f8526c0e05b831f5bcfab7a3fac178b74d8a39b902c
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
3d30dd9423a2fc4bd91525512490fb30f37a714a0883e7c10dc9f07df8200cd1
413977e48a363220c4c8145b9d719ab0b1db81aa5d5ad20d2d7537013ed5e96f
485bf250acef233a906a3026cae439fe87191d6a25c84bfcd4e767b99b442fc4
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb
48e218b49ac260c64e5c3cd69f7e4c5122ff9a77e3a71646ec23400c58f7850e
4b599580e039518368c577e2dad9fef97d2ace48544b6be54f041540937495bf
4b8f65546caa8f567c7eb1358bd4bbfe3416ae2449f713ddcf02e3c03f9b16d1
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892
507bacd01b816361feb7cdb8faf9bfbf648670961b780e7817406c86bcea6bd4
50feb77bcb27d97af6fd667041da94b56628ec866750785cd91e44117ef5f695
538f06fc9a023cdc540c6500319733b5e983ec773b02a22e1f70e821ea7ad959
5c9458830d50902958e42fbfcda039adefff95c0a87fbdeec49081189794c6a6
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33
6b0f84da47d72c369868b8e3af574a3595ef268ae99d3353f694e6d00d2c1167
6c8896402bbf07a912806f65abf3a2114da1aec0ad0ac738d75cf04909d17479
6dd7e7ea596e944778e78ccd97a2e17837ef633d69cad2108842d4ddcb958b1c
738fd9d2b01286a8638545cf324a7847811e1e183f2b2586b99d2360e562023f
774d617bda63a971889ef9d31f4a041fc9492cdd2cfff41dfd9992f3785cdc9d
79b630ad624ae9d9244f06b3a6312c919919d9472ded2e06885432b986289c72
7d79596300bbb0d5208efbeb996a0dd57030fb5bed5f8d1ec3e909054c41ec72
7f0b6183a141ea5e5348f55566ab5f830a4d1a29bc1e09d4eee6e198654b12a7
7fb814cb1e0545a25c9f4bdc9ada88da44ae089ae8c9adfea25c02e725234c1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d1830dba8ae02c13124822f990ff7a891b8e4e7f9f60318aeb4ee6789429dc
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d
b1fd7ed49a8246ec384c86e59d428c8ab8bbcbb247eaa0f8866d92f47ce7b6f5
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
bec883a0d4e03df40770bcb192bf4738fb62cfdfb27d7b0f43a8a24255c5dc64
c6a829f58a8fe8b598408dcd169bb42d30ec6b0c4e9508408074a40d5c393c66
ccbea8a338b25c0159e3a49102ab661a444cb412c152da0744c52584b2e43a4a
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7
cee164a802cd4c573942d517048393e035dbd40f7f3bc5829c36d42e289519e8
d3b7f78941a8927448bb7ea1ab5f10edadb8e4a8e0f2e2e9c47087a9b5c16d76
d726fe9c929df177ce82c1bb81e6f4483f60dec0d68226bc3d5662a10570eef1
d9364216b1e2cd1f78bb9881a5d360dacefc3516fc345b6d9ef65274b5ed5a9f
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc0a21fef5e9de80ffb40de0e8e1abb5ee07df8add5d4701da04dd5b2a947cd4
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a
eb815c0a9dc0c022eebbaab88f1413f0ab1a49013a63b901ac6483fdd1dc3fcd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f050ff666efc1e212f08290a3996c1d66e0e7d9550bc8d10b6c36071b796c16c
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c
f4b97e761f9ed3ac27a5bf303831fdf534b1c0271a879dff72f9622938d3124a
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27
f8e8baebac4f64ee22208b08a36fa7bb4996b541e95b03f978e7318bf2c8b362
fda2122ce926e320bfeba9242ac6add42333255ba0348b9a472352cbdb42a0e6