www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

17 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

• https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
• https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 99

• https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585239257503&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c8=&c9=&cs_ucfr=0 HTTP 302
• https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585239257503&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c8=&c9=&cs_ucfr=0

Request Chain 230

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 231

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 232

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 233

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 246

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 248

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 265

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635

Request Chain 266

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635

Request Chain 267

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635

Request Chain 272

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635

Request Chain 273

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635

Request Chain 274

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635

280 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
11 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/	68 KB 15 KB	675ms 608ms	Document text/html	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51d11ca6f849505ab95a9ea2d30be6af0a985db0d7683c0c8602b6326d1097ee Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.bleepingcomputer.com :scheme https :path /news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Thu, 26 Mar 2020 16:14:15 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d4e60ab62e7cd62540aed145a5db4f7c41585239254; expires=Sat, 25-Apr-20 16:14:14 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=853a42b92dc26890b3799a7832fcbcde; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=7798; expires=Sat, 25-Apr-2020 16:14:15 GMT; Max-Age=2592000; path=/;Secure content-security-policy upgrade-insecure-requests; x-frame-options SAMEORIGIN cache-control no-cache, no-store, must-revalidate pragma no-cache expires 0 last-modified Tue, 25 Feb 2020 20:59:01 GMT vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 57a229deb809d90d-AMS content-encoding br
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	17ms 15ms	Stylesheet text/css	2a00:1450:4001:816::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dda7ea92135dcf21660d4d79391d303fc38f6a6524ae74bbe2986f1d2e990d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:15 GMT server ESF date Thu, 26 Mar 2020 16:14:15 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:15 GMT
GET H2	200	bootstrap.css www.bleepstatic.com/css/redesign/	111 KB 17 KB	109ms 66ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/bootstrap.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e7c74d95df84ef3a6be5c4fcde54fae313a04a9bd611059e6a97a23ff09f26f Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 355436 cf-polished origSize=137522 status 200 cf-bgj minify last-modified Fri, 23 Sep 2016 14:33:06 GMT server cloudflare etag W/"2184297232" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e2d9cbc775-AMS expires Sun, 26 Apr 2020 13:30:19 GMT
GET H2	200	main.css www.bleepstatic.com/css/redesign/	51 KB 9 KB	90ms 47ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9e727b37a735a7983ea8bdad06a38b246261c239bb80b86cc0ff3663c910adb Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 113772 cf-polished origSize=60842 status 200 cf-bgj minify last-modified Thu, 16 Aug 2018 15:28:40 GMT server cloudflare etag W/"4249134023" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e2d9d2c775-AMS expires Wed, 29 Apr 2020 08:38:03 GMT
GET H2	200	home.css www.bleepstatic.com/css/redesign/	12 KB 3 KB	83ms 40ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/home.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3498f138f5418bd58413e79e4c0969e618d6f2fee2d9d98c0f4e70a6cbd04ad Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 448 cf-polished origSize=14998 status 200 cf-bgj minify last-modified Sat, 24 Mar 2018 16:18:00 GMT server cloudflare etag W/"2402535603" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e2d9d1c775-AMS expires Wed, 27 Mar 2019 21:45:08 GMT
GET H2	200	news.css www.bleepstatic.com/css/redesign/	27 KB 5 KB	88ms 45ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/news.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d44b93a0af159f0d547d7ec89e9227a5667ce1171bc630e6fbf79dae0e596e2d Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 7184 cf-polished origSize=32905 status 200 cf-bgj minify last-modified Tue, 26 Nov 2019 02:56:16 GMT server cloudflare etag W/"400467278" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e2d9cec775-AMS expires Thu, 09 Jan 2020 10:58:56 GMT
GET H2	200	jquery-1.11.1.min.js Show response www.bleepstatic.com/js/redesign/	94 KB 32 KB	98ms 55ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT last-modified Thu, 23 Apr 2015 12:36:44 GMT server cloudflare age 1660 etag W/"3647451394" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a229e2d9d5c775-AMS access-control-allow-origin * expires Tue, 10 Dec 2019 08:09:38 GMT
GET H2	200	news.js Show response www.bleepstatic.com/js/redesign/	183 B 252 B	83ms 41ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/news.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 643735 cf-polished origSize=247 status 200 cf-bgj minify last-modified Wed, 16 Dec 2015 15:41:46 GMT server cloudflare etag W/"4218930423" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e2d9d9c775-AMS expires Thu, 23 Apr 2020 05:25:20 GMT
GET H2	200	connatix.renderer.infeed.min.js Show response cdn.connatix.com/min/	957 B 1 KB	1101ms 24ms	Script application/javascript	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 45a3f5d0135ab059ea2ad9f75b800440db8c2c98ae88afacf19cd3366a71f010 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT via 1.1 varnish server Varnish age 0 x-cache HIT content-type application/javascript status 200 x-referer-host bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1585239257.529243,VS0,VE1 content-length 957 retry-after 0 x-served-by cache-fra19141-FRA
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	3 KB 1 KB	32ms 31ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 665900 cf-polished origSize=3848 status 200 cf-bgj minify last-modified Thu, 07 Feb 2019 13:49:44 GMT server cloudflare etag W/"3981350888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e31abac775-AMS expires Wed, 22 Apr 2020 23:15:55 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	75 KB 28 KB	19ms 14ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 730bfff26abc95bea2467f53e7d88821e991530afe15737608f5972b45f97abd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br status 200 strict-transport-security max-age=31536000; includeSubDomains alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28637 x-xss-protection 0 last-modified Thu, 26 Mar 2020 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 26 Mar 2020 16:14:15 GMT
GET H2	200	logo.png www.bleepstatic.com/images/site/	1 KB 1 KB	39ms 35ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 118066 cf-polished origFmt=png, origSize=1882 status 200 content-disposition inline; filename="logo.webp" cf-bgj imgq:85 content-length 1152 last-modified Sat, 04 Mar 2017 04:12:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e36badc775-AMS expires Fri, 24 Apr 2020 07:26:28 GMT
GET H2	200	brand Show response cse.google.com/coop/cse/ Redirect Chain https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en	3 KB 2 KB	25ms 6ms	Script text/javascript	2a00:1450:4001:815::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software pfe / Resource Hash 4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 15:54:59 GMT content-encoding gzip x-content-type-options nosniff server pfe age 1156 x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 content-disposition attachment; filename="f.txt" alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1181 x-xss-protection 0 expires Thu, 26 Mar 2020 16:24:59 GMT Redirect headers date Thu, 26 Mar 2020 16:14:15 GMT x-content-type-options nosniff server sffe location https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 266 x-xss-protection 0
GET H2	200	Worm_Malware.png www.bleepstatic.com/content/hl-images/2019/03/12/	652 KB 652 KB	39ms 35ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2019/03/12/Worm_Malware.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 487623344843550f6b30fd21fe613563803ce9da29c1438b1daceb082e2a4410 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 101195 cf-polished origFmt=png, origSize=1251327 status 200 content-disposition inline; filename="Worm_Malware.webp" cf-bgj imgq:85 content-length 667206 last-modified Tue, 12 Mar 2019 15:01:47 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e36bb0c775-AMS expires Fri, 24 Apr 2020 12:07:40 GMT
GET H2	200	txt-record.jpg www.bleepstatic.com/images/news/malware/m/mozart/	21 KB 21 KB	36ms 33ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/m/mozart/txt-record.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 622647f9d2cc19373a949876b6a67c13ea9c0c595025e89ecea26c245ead03e2 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 101195 cf-polished qual=85, origFmt=jpeg, origSize=44104 status 200 content-disposition inline; filename="txt-record.webp" cf-bgj imgq:85 content-length 21244 last-modified Mon, 24 Feb 2020 20:26:26 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e36bb2c775-AMS expires Fri, 24 Apr 2020 12:07:40 GMT
GET H2	200	jscript.jpg www.bleepstatic.com/images/news/malware/m/mozart/	79 KB 79 KB	85ms 81ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/m/mozart/jscript.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81b2c8cf2ff5e6ebb531545141dd88378485e692e8006a8953e8530279149b70 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 101195 cf-polished qual=85, origFmt=jpeg, origSize=175217 status 200 content-disposition inline; filename="jscript.webp" cf-bgj imgq:85 content-length 80660 last-modified Mon, 24 Feb 2020 20:35:03 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e36bb3c775-AMS expires Fri, 24 Apr 2020 12:07:40 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	107 KB 38 KB	29ms 25ms	Script text/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3c005dba1d518d8fcd6bb8b0cd5264947d7c8c5b53363556d98c453428a376ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 39033 x-xss-protection 0 server cafe etag 13352514705584774431 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 26 Mar 2020 16:14:15 GMT
GET H2	200	twitter.png www.bleepstatic.com/images/site/login/	282 B 447 B	86ms 82ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1873364 cf-polished origFmt=png, origSize=475 status 200 content-disposition inline; filename="twitter.webp" cf-bgj imgq:85 content-length 282 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e36bb4c775-AMS expires Fri, 03 Apr 2020 23:51:31 GMT
GET H2	200	bootstrap.js Show response www.bleepstatic.com/js/redesign/	44 KB 10 KB	37ms 34ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bootstrap.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 1536 cf-polished origSize=65813 status 200 cf-bgj minify last-modified Thu, 23 Apr 2015 12:36:43 GMT server cloudflare etag W/"3930092018" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e36bb6c775-AMS expires Tue, 10 Dec 2019 08:11:55 GMT
GET H2	200	blazy.min.js Show response www.bleepstatic.com/js/blazy/	5 KB 2 KB	34ms 30ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/blazy/blazy.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT last-modified Thu, 16 Aug 2018 21:06:19 GMT server cloudflare age 118067 etag W/"753357888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a229e36ba8c775-AMS access-control-allow-origin * expires Wed, 29 Apr 2020 07:26:28 GMT
GET H2	200	bleep.js Show response www.bleepstatic.com/js/redesign/	3 KB 1 KB	36ms 33ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bleep.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 665899 cf-polished origSize=3600 status 200 cf-bgj minify last-modified Mon, 01 Oct 2018 12:47:57 GMT server cloudflare etag W/"2696894447" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e36bb9c775-AMS expires Wed, 22 Apr 2020 23:15:56 GMT
GET H2	200	jquery.fancybox.js Show response www.bleepstatic.com/js/redesign/fancybox/	31 KB 9 KB	85ms 82ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 115352 cf-polished origSize=48706 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"327140449" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e36bbcc775-AMS expires Wed, 29 Apr 2020 08:11:43 GMT
GET H2	200	fixto.min.js Show response www.bleepstatic.com/js/fixto/	8 KB 3 KB	95ms 90ms	Script text/javascript	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/fixto/fixto.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Jun 2015 21:34:42 GMT server cloudflare age 1179 etag W/"1740214911" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a229e36baac775-AMS access-control-allow-origin * expires Wed, 11 Dec 2019 05:46:52 GMT
GET H2	200	addthis_widget.js Show response s9.addthis.com/js/300/	349 KB 113 KB	127ms 34ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s9.addthis.com/js/300/addthis_widget.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Tue, 21 Jan 2020 20:57:37 GMT server nginx/1.15.8 etag "5e2765c1-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Thu, 26 Mar 2020 16:14:15 GMT x-host s9.addthis.com content-length 114924
GET H2	200	beacon.min.js Show response static.cloudflareinsights.com/	5 KB 2 KB	75ms 29ms	Script text/javascript	2606:4700::6810:5e41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 09b2e724df0f0cf1e698fb41c181badca91e1dce58f4904203b8779d2397440e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 status 200 cf-ray 57a229e3af342488-FRA
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	440 KB 117 KB	83ms 62ms	Script application/javascript	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 990ffe7fb51bb1c268b09f421165e486737d8277adefab5b5c6867acdc6ee83e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding br cf-cache-status HIT age 48 status 200 x-guploader-uploadid AEnB2UqmD1z5dnO78KZf9fYVh_lAD91W1PtO-v72oaL4T9iiWKyE36JRsXVv7VKKXtVaD0SVdApiAl160xrMrSbZawEcswwQEw x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Fri, 20 Mar 2020 20:07:32 GMT server cloudflare etag W/"1173359ed7df956afd617e45530903b3" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=cm/Q+g==, md5=EXM1ntfflWr9YX5FUwkDsw== content-type application/javascript x-goog-generation 1584734852947887 cache-control public, max-age=1800 x-goog-stored-content-length 450440 cf-ray 57a229e37f0a1786-FRA expires Thu, 26 Mar 2020 16:14:27 GMT
GET H/1.1	200 OK	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	136ms 25ms	Script application/javascript	178.79.175.86 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.79.175.86 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS nb-178-79-175-86.london.nodebalancer.linode.com Software nginx/1.12.2 / Resource Hash affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 16:23:02 GMT Content-Encoding gzip Last-Modified Wed, 15 Jul 2015 00:00:00 GMT Server nginx/1.12.2 ETag "55a5a280-560" Content-Type application/javascript Cache-Control max-age=3600 Connection close Content-Length 1376 Expires Thu, 26 Mar 2020 17:23:02 GMT
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	login_bg.png www.bleepstatic.com/images/site/	126 B 414 B	81ms 80ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1421537 cf-polished origFmt=png, origSize=187 status 200 content-disposition inline; filename="login_bg.webp" cf-bgj imgq:85 content-length 126 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c09c775-AMS expires Thu, 09 Apr 2020 05:21:58 GMT
GET H2	200	nav_bg.png www.bleepstatic.com/images/site/	72 B 234 B	95ms 95ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/nav_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 118066 cf-polished origFmt=png, origSize=83 status 200 content-disposition inline; filename="nav_bg.webp" cf-bgj imgq:85 content-length 72 last-modified Sat, 04 Mar 2017 07:57:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c0bc775-AMS expires Fri, 24 Apr 2020 07:26:29 GMT
GET H2	200	20x20-printer.png www.bleepstatic.com/images/site/	422 B 590 B	87ms 85ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/20x20-printer.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1588603 cf-polished origFmt=png, origSize=824 status 200 content-disposition inline; filename="20x20-printer.webp" cf-bgj imgq:85 content-length 422 last-modified Sat, 03 Oct 2015 03:18:32 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c0fc775-AMS expires Tue, 07 Apr 2020 06:57:31 GMT
GET H2	200	calendar.png www.bleepstatic.com/images/site/	86 B 430 B	86ms 85ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/calendar.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1872073 cf-polished origFmt=png, origSize=129 status 200 content-disposition inline; filename="calendar.webp" cf-bgj imgq:85 content-length 86 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c11c775-AMS expires Sat, 04 Apr 2020 00:13:02 GMT
GET H2	200	clock.png www.bleepstatic.com/images/site/	252 B 413 B	97ms 96ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/clock.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 117120 cf-polished origFmt=png, origSize=1316 status 200 content-disposition inline; filename="clock.webp" cf-bgj imgq:85 content-length 252 last-modified Fri, 29 May 2015 07:08:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c14c775-AMS expires Fri, 24 Apr 2020 07:42:15 GMT
GET H2	200	comment-light.png www.bleepstatic.com/images/site/	96 B 264 B	86ms 86ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comment-light.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 664081 cf-polished origFmt=png, origSize=1034 status 200 content-disposition inline; filename="comment-light.webp" cf-bgj imgq:85 content-length 96 last-modified Fri, 29 May 2015 07:08:28 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e38c17c775-AMS expires Fri, 17 Apr 2020 23:46:14 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2446029 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 4807436 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	8ms 8ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1860777 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1861296 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	cmp.js Show response quantcast.mgr.consensu.org/	264 KB 76 KB	63ms 4ms	Script text/javascript	2600:9000:20eb:2c00:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/cmp.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:2c00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bc73cc3b5fbc98895f0b459237df3d9aa111098c787650e72cda7eadf27388df Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:06:22 GMT content-encoding gzip last-modified Tue, 24 Mar 2020 19:10:19 GMT server AmazonS3 age 1287 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-meta-qc-ineu True x-amz-cf-pop FRA2-C1 x-amz-cf-id Ffi9-WZmkQWeA4iZmMa7suxPBBHz6bDEEihaqcmV19B7zfGLGzQsWQ== via 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
GET H2	200	32x32-printer.png www.bleepstatic.com/images/site/	256 B 425 B	34ms 22ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/32x32-printer.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1880358 cf-polished origFmt=png, origSize=618 status 200 content-disposition inline; filename="32x32-printer.webp" cf-bgj imgq:85 content-length 256 last-modified Fri, 02 Oct 2015 21:57:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e40dc8c775-AMS expires Fri, 03 Apr 2020 21:54:57 GMT
GET H2	200	21beb902b545b086a90ec39f1df36b94.jpg www.bleepstatic.com/author/photos/	7 KB 8 KB	37ms 25ms	Image image/jpeg	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19e1dbba639ba68ceb71cdada9621e11d0aec6edba410971f1937d6cc4935b32 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 201123 cf-polished origSize=7617, status=webp_bigger status 200 cf-bgj imgq:85 content-length 7581 last-modified Mon, 26 Oct 2015 17:15:33 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e40dc9c775-AMS expires Thu, 23 Apr 2020 08:22:11 GMT
GET H2	200	h4-bg.png www.bleepstatic.com/images/site/	38 B 351 B	34ms 23ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/h4-bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 1881855 cf-polished origFmt=png, origSize=72 status 200 content-disposition inline; filename="h4-bg.webp" cf-bgj imgq:85 content-length 38 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e40dcac775-AMS expires Fri, 03 Apr 2020 21:29:59 GMT
GET H2	200	news_email_icon.png www.bleepstatic.com/images/site/	126 B 402 B	181ms 170ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_email_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a Request headers Referer https://www.bleepstatic.com/css/redesign/home.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 664081 cf-polished origFmt=png, origSize=1105 status 200 content-disposition inline; filename="news_email_icon.webp" cf-bgj imgq:85 content-length 126 last-modified Fri, 29 May 2015 07:10:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e40dcbc775-AMS expires Fri, 17 Apr 2020 23:46:14 GMT
GET H2	200	news_footer_icon.png www.bleepstatic.com/images/site/	110 B 352 B	46ms 45ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_footer_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:15 GMT cf-cache-status HIT age 665898 cf-polished origFmt=png, origSize=186 status 200 content-disposition inline; filename="news_footer_icon.webp" cf-bgj imgq:85 content-length 110 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e44edfc775-AMS expires Fri, 17 Apr 2020 23:15:56 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 171 B	15ms 15ms	Script application/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 171 B	17ms 17ms	Script application/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/	224 KB 84 KB	31ms 30ms	Script text/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1fea51227a0d0a882dcf26ad5791bdf3bbb79958e076630e86427a8266300a2a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 85515 x-xss-protection 0 server cafe etag 13950792502640807200 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Thu, 26 Mar 2020 16:14:15 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20200319/r20190131/ Frame DA26	0 0	8ms 6ms	Document text/html	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20200319/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20200319/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US cookie test_cookie=CheckForPermission Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * vary Accept-Encoding date Sat, 21 Mar 2020 12:05:08 GMT expires Sat, 04 Apr 2020 12:05:08 GMT content-type text/html; charset=UTF-8 etag 17714563530871986051 x-content-type-options nosniff content-encoding gzip server cafe content-length 4497 x-xss-protection 0 cache-control public, max-age=1209600 age 446947 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 5740 date Thu, 26 Mar 2020 14:38:35 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 18174 expires Thu, 26 Mar 2020 16:38:35 GMT
GET H2	200	cmp-3pc-check.html static.quantcast.mgr.consensu.org/v32/ Frame 1F82	0 0	20ms 6ms	Document text/html	2600:9000:20eb:fa00:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v32/cmp-3pc-check.html Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:fa00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority static.quantcast.mgr.consensu.org :scheme https :path /v32/cmp-3pc-check.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 content-type text/html content-length 645 last-modified Tue, 24 Mar 2020 19:10:15 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 date Thu, 26 Mar 2020 16:12:57 GMT etag "55b98270d639ef0c34781d9f03cce91f" x-cache Hit from cloudfront via 1.1 7a18a0a1d9929dae345690b88b08dd5e.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id 5JSPCKtygxbf8zvBrKMDVaM9JjhL0ZiRVx1Mb59TzrJvyWIzcPwitA== age 859
GET H/1.1	200 OK	cookie Show response d.pub.network/	36 B 472 B	1740ms 117ms	XHR text/plain	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/cookie Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash fb49420c70242beea898a0c7ea172e365836dddc6ce142d1863f1c2e2b0add0a Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:17 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	44 KB 14 KB	43ms 42ms	Script text/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash da381186ecb4be3bc20eb8bca859d85cd7b604061e963c70436a8f8d8ff04387 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:15 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "467 / 781 of 1000 / last-modified: 1585081375" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14727 x-xss-protection 0 expires Thu, 26 Mar 2020 16:14:15 GMT
GET H/1.1	200 OK	gallery.js Show response freestar-io.videoplayerhub.com/	101 KB 26 KB	152ms 51ms	Script application/javascript	99.84.155.18 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://freestar-io.videoplayerhub.com/gallery.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.84.155.18 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-155-18.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash ad4d57b8c2ac583a0b890f4bd88990ecbe76a7e1463f2508dd7cde85fa55aad9 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id HyfDQPRwTVUvKVqE3e.nnmfw7fIrXN8d Content-Encoding gzip Last-Modified Tue, 24 Mar 2020 16:08:09 GMT Server AmazonS3 Age 38 Date Thu, 26 Mar 2020 16:14:15 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 117b54f007fbf40fc2a4bbbd8e88fc21.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop TXL52-C1 Connection keep-alive X-Amz-Cf-Id afx9ySCeyEe3MmejxxIWLyuJGmrwpL8e70nwj6V9GWYl_upLG2qHmQ==
GET H2	200	prebid-analytics-3.6.2.js Show response a.pub.network/core/	350 KB 107 KB	167ms 167ms	Script text/html	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/core/prebid-analytics-3.6.2.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bfc61f56cf987bfbf5e1c86e6746d24c7dcd6ad98806dfca9d63c6110810582 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding br cf-cache-status BYPASS status 200 x-guploader-uploadid AEnB2UoRFRJxz9OINzBB2p6IQpxqUkTw5QNAlGUeNSPWpq9SsvVZzXb94lnhonOxAjhxk1rQIiCK4KMWlmOZveOTvX7aTb_ibg x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 3 x-goog-stored-content-encoding identity last-modified Fri, 28 Feb 2020 20:11:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ== content-type text/html x-goog-generation 1582920668771105 cache-control private x-goog-stored-content-length 358240 cf-ray 57a229e5fe081786-FRA expires Fri, 26 Mar 2021 16:14:16 GMT
GET H/1.1	200 OK	location Show response d.pub.network/	51 B 498 B	3525ms 120ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/location Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:19 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	292x176_HPEDrives.png www.bleepstatic.com/content/posts/2020/03/24/thumb/	66 KB 67 KB	30ms 28ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/posts/2020/03/24/thumb/292x176_HPEDrives.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35d66691f7a14594746c42c7ba82ffdd41b07a8508656195d6e1a956023a44a1 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:16 GMT cf-cache-status HIT age 104541 cf-polished origFmt=png, origSize=106329 status 200 content-disposition inline; filename="292x176_HPEDrives.webp" cf-bgj imgq:85 content-length 68014 last-modified Tue, 24 Mar 2020 22:14:24 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e60cb3c775-AMS expires Fri, 24 Apr 2020 11:11:55 GMT
GET H2	200	292x176_Windows-Update.jpg www.bleepstatic.com/content/hl-images/2017/04/06/thumb/	4 KB 4 KB	32ms 31ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2017/04/06/thumb/292x176_Windows-Update.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e1645236a3a45146c3498b755cfd559d3f866cddcdaa605c948b6864c9501c9 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:16 GMT cf-cache-status HIT age 76822 cf-polished qual=85, origFmt=jpeg, origSize=4080 status 200 content-disposition inline; filename="292x176_Windows-Update.webp" cf-bgj imgq:85 content-length 3604 last-modified Thu, 06 Apr 2017 10:23:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229e60cb8c775-AMS expires Fri, 24 Apr 2020 18:53:54 GMT
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 477 B	821ms 22ms	Image image/x-icon	216.58.207.38 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s24-in-f6.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 06:19:05 GMT content-encoding gzip x-content-type-options nosniff age 35711 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes expires Fri, 27 Mar 2020 06:19:05 GMT
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	67ms 22ms	Script application/x-javascript	95.101.185.246 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-246.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id 3DA20F33DFB043F4 etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=16471 accept-ranges bytes content-length 948 x-amz-id-2 g7+QTkfgFpKXdjIV1ns3PedgNVHG4mi9TLupYfjziOmGieTRD5DTu0V21U3C4oqBbTG5njMGxL0=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/	2 KB 855 B	32ms 31ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip etag -1659864586--gzip vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=20, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 678
GET H2	200	cmpui-popup.js Show response static.quantcast.mgr.consensu.org/v32/	266 KB 75 KB	7ms 6ms	Script text/javascript	2600:9000:20eb:fa00:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v32/cmpui-popup.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:fa00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 10e73f57ed1405cdfe501a57b808fe434d5c073966be89bd7cc917e485c8bda6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:01:21 GMT content-encoding gzip last-modified Tue, 24 Mar 2020 19:10:15 GMT server AmazonS3 age 775 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-cf-pop FRA2-C1 x-amz-cf-id 7WsAuOv58yf_Xap-DWcOHOohAsozbAEYk4CKZxqldXgUV09PpkTI5w== via 1.1 7a18a0a1d9929dae345690b88b08dd5e.cloudfront.net (CloudFront)
GET H2	200	jquery.fancybox.css www.bleepstatic.com/js/redesign/fancybox/	4 KB 1 KB	45ms 44ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding br cf-cache-status HIT age 242 cf-polished origSize=4895 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"9108074" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e67e3dc775-AMS expires Fri, 01 Nov 2019 06:12:37 GMT
GET H2	200	font-awesome.css www.bleepstatic.com/css/redesign/	22 KB 5 KB	28ms 27ms	Stylesheet text/css	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/font-awesome.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding br cf-cache-status HIT age 1594 cf-polished origSize=26776 status 200 cf-bgj minify last-modified Tue, 03 May 2016 04:39:29 GMT server cloudflare etag W/"1700274315" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a229e67e40c775-AMS expires Wed, 03 Jul 2019 05:12:31 GMT
GET H2	200	collect www.google-analytics.com/r/	35 B 101 B	13ms 13ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1929598678&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ul=en-us&de=UTF-8&dt=New%20Mozart%20Malware%20Gets%20Commands%2C%20Hides%20Traffic%20Using%20DNS&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=2030210911&gjid=1268030851&cid=645827379.1585239256&tid=UA-91740-1&_gid=1040618366.1585239256&_r=1&gtm=2ou3i0&z=1254281826 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:16 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_2020032302.js Show response securepubads.g.doubleclick.net/gpt/	168 KB 62 KB	32ms 32ms	Script text/javascript	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software sffe / Resource Hash 26fd020a6c1f169eab6b6232014e6e6d067788f63a8995b682ee77d6f41b56cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Mar 2020 17:22:36 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 62957 x-xss-protection 0 expires Thu, 26 Mar 2020 16:14:16 GMT
GET H2	200	fontawesome-webfont.woff www.bleepstatic.com/fonts/	64 KB 64 KB	568ms 23ms	Font application/octet-stream	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1 Request headers Referer https://www.bleepstatic.com/css/redesign/font-awesome.css Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:16 GMT cf-cache-status HIT last-modified Thu, 23 Apr 2015 09:36:00 GMT server cloudflare age 1513 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/octet-stream status 200 accept-ranges bytes cf-ray 57a229ea39c8d8b1-AMS access-control-allow-origin * content-length 65452
GET H2	200	vendorlist.json Show response vendorlist.consensu.org/	95 KB 18 KB	43ms 14ms	XHR application/json	2600:9000:214f:6800:1:af78:4c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vendorlist.consensu.org/vendorlist.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:6800:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1f71cda9ecc5006fb453c9761058c0828d30d4a7f891283718da1b545ab2afb1 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:13:24 GMT content-encoding gzip vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 53 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 26 Mar 2020 16:00:32 GMT server AmazonS3 access-control-max-age 604800 access-control-allow-methods GET x-amz-version-id EUWGyjsu5r7VdMzn2Ehby5QynGejxuEd via 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront) cache-control max-age=604800 x-amz-cf-pop FRA53-C1 content-type application/json; charset=utf-8 x-amz-cf-id htEqG_awaI9jOlvjzyWxKmRKddW2-pFeLaf0jSpU5OJUXy2w9Ma36g==
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	50ms 49ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Thu, 26 Mar 2020 16:14:16 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H2	200	apstag.js Show response c.amazon-adsystem.com/aax2/	87 KB 25 KB	1600ms 51ms	Script application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aax2/apstag.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 25 Mar 2020 22:00:54 GMT content-encoding gzip server Server age 65602 etag 1dcfbf3986ee8b9c3abbc67eb808ab43 x-cache Hit from cloudfront content-type application/javascript status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id ZT14nlQN2ekQ8woHoJptq_0MmpZtbULMMZ-wszZmzPCCUA8g-Nw2JQ== via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/	86 KB 19 KB	3593ms 22ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4e5ad4d589557f1b46b8232468ced4a184eab3e3f0fb3330ab06712456ed1240 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 16:14:19 GMT Content-Encoding gzip Age 2080 X-Cache HIT Connection keep-alive Content-Length 18732 x-amz-id-2 8kT5VT5/zp+amNFz28ivg+exMPnG1LTfNHP+PUpWj1KOH5mNfaI97owsuinK82/jFPsj9YcIKO8= X-Served-By cache-fra19152-FRA Last-Modified Thu, 26 Mar 2020 15:35:31 GMT Server AmazonS3 X-Timer S1585239260.791810,VS0,VE0 ETag "750dd48c8816e5071351febcba878b57" x-amz-request-id 17FDDE57D67A2E8B Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 66
GET H/1.1	200 OK	v2 Show response d.pub.network/floors/	2 KB 2 KB	1577ms 189ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/floors/v2?key=535desktop Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 8e2e31ca15e11b96765b041401fd28c5453f021a89202dfd90086204d2c6433a Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:17 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	404	CookieAccess Show response api.quantcast.mgr.consensu.org/	30 B 595 B	167ms 126ms	XHR application/json	13.224.194.98 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.quantcast.mgr.consensu.org/CookieAccess Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.194.98 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-98.fra2.r.cloudfront.net Software / Resource Hash 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip x-amz-cf-pop FRA2-C1 x-amzn-requestid a565026f-84ca-47f1-ae63-0b1355614c96 x-cache Error from cloudfront status 404 x-amz-apigw-id KAYx0E3NoAMFsLw= content-length 50 access-control-allow-origin https://www.bleepingcomputer.com x-amzn-trace-id Root=1-5e7cd4d8-f6c76d3ceae4abf84f967be2;Sampled=0 vary Origin access-control-allow-methods GET, POST content-type application/json via 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront) cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Content-Type x-amz-cf-id v0g6DaJuBESYX0FYyx5TgmcerZYTuxgPgvbQWBTtNiAXt1ayhU8ygQ==
GET H2	200	beacon.js Show response ad-delivery.net/	1 KB 988 B	98ms 31ms	Script application/x-javascript	99.84.155.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad-delivery.net/beacon.js Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.84.155.107 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-155-107.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id null content-encoding gzip last-modified Tue, 31 Jan 2017 15:06:54 GMT server AmazonS3 age 1438 date Thu, 26 Mar 2020 15:50:20 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop TXL52-C1 x-amz-cf-id BiLvgtBNyJ4q8GP4nd7zOeNZHIgl4wUIM-8rxYJg9QbftWCTFPtcoQ== via 1.1 3b9e149724e93026c0277288bbe3906a.cloudfront.net (CloudFront)
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	connatix.renderer.infeed.min_dc.js Show response cdns.connatix.com/p/1911/min/ Frame 780C	725 KB 191 KB	90ms 23ms	Script application/x-javascript	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 180ef002784b30cbe662cc5e8cde9b65da0adca8a993371fbb9bfa9a990182e4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip age 1285817 x-cache HIT, HIT status 200 content-length 194812 via 1.1 varnish, 1.1 varnish x-served-by cache-dca17725-DCA, cache-fra19151-FRA last-modified Wed, 11 Mar 2020 19:03:09 GMT x-timer S1585239257.624458,VS0,VE0 etag "ff3bcb0ad90321a624e17d47c9d54127" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31557600 accept-ranges bytes x-cache-hits 1, 67989
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame 3771	0 0	169ms 149ms	Document text/html	2a00:1450:4001:81e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1582664341&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1585239255857&bpp=6&bdt=416&fdt=247&idt=247&shv=r20200319&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4891145582429&frm=20&pv=2&ga_vid=645827379.1585239256&ga_sid=1585239257&ga_hid=1929598678&ga_fc=0&iag=0&icsg=598134501703680&dssz=51&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=44713363&oid=3&pvsid=2746953219665089&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=762 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1582664341&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1585239255857&bpp=6&bdt=416&fdt=247&idt=247&shv=r20200319&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4891145582429&frm=20&pv=2&ga_vid=645827379.1585239256&ga_sid=1585239257&ga_hid=1929598678&ga_fc=0&iag=0&icsg=598134501703680&dssz=51&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=44713363&oid=3&pvsid=2746953219665089&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=762 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US cookie test_cookie=CheckForPermission Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Thu, 26 Mar 2020 16:14:16 GMT server cafe content-length 34 x-xss-protection 0 set-cookie IDE=AHWqTUlrtT0UdP7DoudZZMydbpp1b23M1Ybe-KbTKFyudUzVTmoZRJ8q8oIROT-r; expires=Tue, 20-Apr-2021 16:14:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 expires Thu, 26 Mar 2020 16:14:16 GMT cache-control private
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	74 KB 28 KB	71ms 43ms	Script text/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1585165059237800" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28015 x-xss-protection 0 expires Thu, 26 Mar 2020 16:14:16 GMT
GET H2	200	/ Show response audit.quantcast.mgr.consensu.org/	80 B 487 B	63ms 22ms	XHR text/html	13.225.73.119 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit.quantcast.mgr.consensu.org/?log=;1585239256690;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F;;;;;p,off,false,,1,en,32,195,true,false,false;displayConsentUi:mandatory,;GDPR-jetx56ehfrdo6cz04w8v Requested by Host: static.quantcast.mgr.consensu.org URL: https://static.quantcast.mgr.consensu.org/v32/cmpui-popup.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.73.119 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-73-119.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 06:09:00 GMT via 1.1 91ba7c34719cd9c69e0357c149b94b90.cloudfront.net (CloudFront) vary Origin age 36317 x-cache Hit from cloudfront status 200 content-length 80 last-modified Mon, 11 Jun 2018 22:07:34 GMT server AmazonS3 etag "0614149d8033903db5de46d6c184bbfd" access-control-max-age 3000 access-control-allow-methods GET content-type text/html access-control-allow-origin * x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id NTzSWLITh2Fcmt-Z353SAfWpsVPLBNyBX8Z1bOiFW9Z05313FZaJTQ==
GET H2	200	g Show response ck.connatix.com/	46 B 170 B	30ms 23ms	Script text/plain	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ck.connatix.com/g?callback=cnxJSONP_55bb573f9c5cc19258b51585239256743 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash d42d6374ead2754f311a904020e24d41ef811d3b3188d2aae7f411779222dd44 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:16 GMT via 1.1 varnish server Varnish age 0 x-cache HIT status 200 cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1585239257.758929,VS0,VE0 content-length 46 retry-after 0 x-served-by cache-fra19151-FRA
GET H2	200	pls Show response core.connatix.com/ Frame 780C	6 KB 3 KB	579ms 108ms	Script text/plain	52.4.201.105 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://core.connatix.com/pls?callback=jQuery3210718305578607584_1585239256740&token=83c6e833-8c07-474c-b10f-079d46320a80&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c_v=1911_1_0_0_0&page_guid=3d267483736e71eb56411585239256803&spp=1&_=1585239256741 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.4.201.105 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-4-201-105.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash c0984cc916749120670958a8f81c4f44edcf8a821ab9e8a2778bd2967306ba6c Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 200 date Thu, 26 Mar 2020 16:14:17 GMT content-encoding gzip server nginx/1.15.9 (Ubuntu) access-control-allow-origin *
GET H/1.1	200 OK	jquery.color-2.1.2.min.js Show response cluster-na.cdnjquery.com/color/	92 B 356 B	3900ms 321ms	Script text/javascript	34.226.186.251 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1585239256814&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%22d719a5ef-6f7c-11ea-b6db-d9bc84c49779%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&csVersion=1.21.48&clearThroughOptions=undefined Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.226.186.251 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-186-251.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash a85151c1881457b3f08182cac7ce9350bcd3bc7b8388d603d15eb33593004ba5 Security Headers Name Value X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 16:14:20 GMT Content-Encoding gzip Server nginx/1.12.1 ETag W/"5c-cC/S64ImwIUPT0NYF2ie+uqKAAo" X-Frame-Options DENY Content-Type text/javascript; charset=utf-8 Charset utf8 Connection keep-alive Content-Length 84
GET		px.gif ad-delivery.net/	0 0
GET H2	200	48.008759e9efe1c1b693dd.js Show response s7.addthis.com/static/	281 B 486 B	76ms 26ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-119" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Thu, 26 Mar 2020 16:14:17 GMT x-host s7.addthis.com timing-allow-origin * content-length 246
GET H2	200	/ Show response graph.facebook.com/	306 B 418 B	70ms 56ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_b9bs0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c51ffc8ecd94a9bac133ef044b3d10f2fab77c229a875d45fbed33734daa6770 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload content-encoding br x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Thu, 26 Mar 2020 16:14:17 GMT, Thu, 26 Mar 2020 16:14:17 GMT x-fb-rev 1001901918 alt-svc h3-27=":443"; ma=3600 content-length 215 pragma no-cache x-fb-debug 15g5XXXykcEwSDKCeMAwwrgLSRvpIqo7bPkrllyHqk2eE6c3WpjzzmYVBacMhB80hfOlqadwKiA+JtvcpazK+Q== x-fb-trace-id HtIkzw0W/f0 etag "b60c7fbfdda1f59e1123560b1673d374b18f7ad3" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id AAJzZqrKIf5VKjkYG9IY011 cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	8 KB 2 KB	456ms 151ms	Script application/javascript	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&jsonp=_ate.cbs.rcb_gpp60 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 77a29de3ece6fab4f7d65cf2c9888c728a7376333a61762d39bc402b1b020e89 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:17 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 1993 x-xss-protection 1; mode=block x-served-by cache-man4136-MAN x-moose majestic server snooserv x-timer S1585239257.437259,VS0,VE123 x-frame-options SAMEORIGIN vary accept-encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	/ Show response graph.facebook.com/	144 B 600 B	53ms 40ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_h6g80 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 56943af53e18f817b01a0969f4dc11610e0f852579eeab796aa6203cbdb15fe1 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Thu, 26 Mar 2020 16:14:17 GMT, Thu, 26 Mar 2020 16:14:17 GMT x-fb-rev 1001901918 alt-svc h3-27=":443"; ma=3600 content-length 144 pragma no-cache x-fb-debug MOqCR2GDkVW9SDoaurutvPuXmelRPw5gAfeRffMILNk1pLEFsjNEfg9YkmuZIoa9sYYTiP890AzPZf54WN74Iw== x-fb-trace-id FTN1g/ay/6U etag "48466d74889a8840c543e117a221a18983a5ceb0" content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id ACVX2adxKxAT4sa5IfTklAR cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 669 B	444ms 139ms	Script application/javascript	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&jsonp=_ate.cbs.rcb_5ivt0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash aafbd1a3e4ff637a72da4b575bafd8bb72a1c89a1185da8aa297155c34aa9f5f Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-man4136-MAN x-moose majestic server snooserv x-timer S1585239257.437244,VS0,VE112 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET DATA	200 OK	truncated /	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	g Show response rtb.connatix.com/	148 B 328 B	1574ms 179ms	Script text/plain	54.83.128.233 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=469&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c_ivt=0&connatix_sess=YxihGX2DSsDXPD6b-rBYFT_9Xge-CkAeXDJaxOM1U9LYM5IqaB0AzYV8_218Q7J2JQh6ODOXzFy0OxY_RFvtpiuOocnD6B-UN5m9T6o1Far7Nr3FOvL6SCiqPOs5ByYVWnYdm4schs-K-14On3W2wrKLDi68V0WHyZ0JRcDtpbIDj_bsW11xTDbAgaw-lmd2&notServed=false&xplr=true&c_s=false&c_pl=hD4ZTGW05hXngzjDGJhWu9YJwvHGndlV7X-XiKpmbpOLZqPXLv-1aWFWIFhHQ4Ss26CLJhIHsj3HY3k3TkRx4II6_yoqR0xuYIQIWXiJSmrJEqN6owqxrmKT1uYNvuJ8GWXCqvpTavnhjkIvLnkbHjU-_4VwZ4yTwcoc1gUlBR4S65F5Pfc6-1MNRyLNSCMxmlIKQiFBJZzBjqHvgRneex1Ovp9zxltEtYOY80e13ACawZwUZBO8vylfDrUl8Zhp-hTpXUNiBoOw9nWYnnHXRw&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=0&v=1&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_865e98f1e0ca1066bd971585239257467 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.83.128.233 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-83-128-233.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash d826788f6713ce2e729b1d7ace6c8d378df7d517d4d8bebcda5fb3cababf659e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 16:14:18 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 140
GET H2	200	426.jpg i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/	30 KB 30 KB	41ms 38ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/426.jpg?mode=stretch&connatiximg=true&scale=both&height=469&width=834 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1f1772d674817c27fc3c9e552fbe73172d7116cb3d80ecd46d1dc14f765ecf8f Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47643 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 4, 2 accept-ranges bytes x-timer S1585239257.480576,VS0,VE0 access-control-allow-origin * content-length 30917 x-served-by cache-sjc10041-SJC, cache-fra19151-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/8a5a24be-fc62-47f3-a6fd-2e5f17ef8f7e/	37 KB 37 KB	26ms 23ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/8a5a24be-fc62-47f3-a6fd-2e5f17ef8f7e/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f4e812683b1e73a9facd0cbdba2f3d7429924d301695896b76c21143fdfa3ee8 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47643 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1585239257.480429,VS0,VE0 access-control-allow-origin * content-length 38201 x-served-by cache-sjc10025-SJC, cache-fra19151-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/ab35f508-7fc3-42ab-98b0-a0f84b0f9919/	95 KB 96 KB	26ms 23ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/ab35f508-7fc3-42ab-98b0-a0f84b0f9919/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3d0d5682c4800b9b9da7bc15c66d9a7383a32308d034664fd3f9f3eae3483dad Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47642 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 2 accept-ranges bytes x-timer S1585239257.480602,VS0,VE0 access-control-allow-origin * content-length 97654 x-served-by cache-sjc10024-SJC, cache-fra19151-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/d27100ae-c776-4356-abc5-6a6bea1601b3/	17 KB 17 KB	25ms 22ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/d27100ae-c776-4356-abc5-6a6bea1601b3/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8258ab6dca6e481db10703021930ca8b0e484c50213ea4c42f8f01fd64e3e57d Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47643 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1585239257.480258,VS0,VE0 access-control-allow-origin * content-length 17157 x-served-by cache-sjc10020-SJC, cache-fra19151-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/f5dec755-0f1b-4c0c-9974-f28594758ffd/	39 KB 39 KB	25ms 24ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/f5dec755-0f1b-4c0c-9974-f28594758ffd/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0c6e8fed85b8d4eacd6452e9180bcfce8c63b219a0b792ddf28608362dbebdf6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47643 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 2 accept-ranges bytes x-timer S1585239258.504497,VS0,VE0 access-control-allow-origin * content-length 40194 x-served-by cache-sjc10031-SJC, cache-fra19151-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/c50e0049-2ba1-4cb6-82c7-7ed0da779ae4/	64 KB 65 KB	31ms 30ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/c50e0049-2ba1-4cb6-82c7-7ed0da779ae4/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9af35b772f64c1cd435f5bf4ba413fca2c2c65cd57cf4a66fe5412732a16a89a Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 47643 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1585239258.504582,VS0,VE0 access-control-allow-origin * content-length 65958 x-served-by cache-sjc10038-SJC, cache-fra19151-FRA
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	1087ms 29ms	Image image/webp	104.26.13.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56e644a617b2d1e4e7d808dfc334a7ea8622979f22999dc9eccd21c61958b3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:18 GMT cf-cache-status HIT age 115765 cf-polished origFmt=png, origSize=15281 status 200 content-disposition inline; filename="bleeping-computerlogo-lg.webp" cf-bgj imgq:85 content-length 7156 last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a229f5d9a9fa6c-AMS expires Fri, 24 Apr 2020 08:04:53 GMT
GET H2	200	0_th_1.jpg i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/ Frame 780C	23 KB 23 KB	31ms 30ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/0_th_1.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c3034d0370c5faa09e7a8d7b0c48925afa0371cf17e4827dde23059f56019dae Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 varnish, 1.1 varnish age 24388294 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 2 accept-ranges bytes x-timer S1585239258.504663,VS0,VE0 access-control-allow-origin * content-length 23507 x-served-by cache-sjc3144-SJC, cache-fra19151-FRA
GET		514171 vid.springserve.com/vast/ Frame 780C	0 0
GET H/1.1	200 OK	p2 sb.scorecardresearch.com/ Frame 780C Redirect Chain https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&ns... https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&n...	43 B 309 B	24ms 24ms	Image image/gif	104.74.100.205 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585239257503&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c8=&c9=&cs_ucfr=0 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.74.100.205 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-74-100-205.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:17 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585239257503&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c8=&c9=&cs_ucfr=0 Pragma no-cache Date Thu, 26 Mar 2020 16:14:17 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	g Show response rtb.connatix.com/	148 B 328 B	1657ms 141ms	Script text/plain	54.83.128.233 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c_ivt=0&connatix_sess=YxihGX2DSsDXPD6b-rBYFT_9Xge-CkAeXDJaxOM1U9LYM5IqaB0AzYV8_218Q7J2JQh6ODOXzFy0OxY_RFvtpiuOocnD6B-UN5m9T6o1Far7Nr3FOvL6SCiqPOs5ByYVWnYdm4schs-K-14On3W2wrKLDi68V0WHyZ0JRcDtpbIDj_bsW11xTDbAgaw-lmd2&notServed=false&xplr=true&c_s=false&c_pl=hD4ZTGW05hXngzjDGJhWu9YJwvHGndlV7X-XiKpmbpOLZqPXLv-1aWFWIFhHQ4Ss26CLJhIHsj3HY3k3TkRx4II6_yoqR0xuYIQIWXiJSmrJEqN6owqxrmKT1uYNvuJ8GWXCqvpTavnhjkIvLnkbHjU-_4VwZ4yTwcoc1gUlBR4S65F5Pfc6-1MNRyLNSCMxmlIKQiFBJZzBjqHvgRneex1Ovp9zxltEtYOY80e13ACawZwUZBO8vylfDrUl8Zhp-hTpXUNiBoOw9nWYnnHXRw&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=1&v=2&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_55681cc1aa2c4918610e1585239257510 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.83.128.233 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-83-128-233.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash fd93e7b26a7e03fdae6159eb1f9a7df5cc24869e878229dd87c867492998dcd7 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 16:14:19 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 140
GET H/1.1	200 OK	r trk.connatix.com/ Frame 780C	0 162 B	7672ms 105ms	Image text/plain	3.213.93.144 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/r?connatix_sess=YxihGX2DSsDXPD6b-rBYFT_9Xge-CkAeXDJaxOM1U9LYM5IqaB0AzYV8_218Q7J2JQh6ODOXzFy0OxY_RFvtpiuOocnD6B-UN5m9T6o1Far7Nr3FOvL6SCiqPOs5ByYVWnYdm4schs-K-14On3W2wrKLDi68V0WHyZ0JRcDtpbIDj_bsW11xTDbAgaw-lmd2&videoID=639404&c_pl=hD4ZTGW05hXngzjDGJhWu9YJwvHGndlV7X-XiKpmbpOLZqPXLv-1aWFWIFhHQ4Ss26CLJhIHsj3HY3k3TkRx4II6_yoqR0xuYIQIWXiJSmrJEqN6owqxrmKT1uYNvuJ8GWXCqvpTavnhjkIvLnkbHjU-_4VwZ4yTwcoc1gUlBR4S65F5Pfc6-1MNRyLNSCMxmlIKQiFBJZzBjqHvgRneex1Ovp9zxltEtYOY80e13ACawZwUZBO8vylfDrUl8Zhp-hTpXUNiBoOw9nWYnnHXRw&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-&c_v=1911_1_0_0_0&spp=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.93.144 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-93-144.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 16:14:25 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET		cygnus as-sec.casalemedia.com/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	728 B 1 KB	1134ms 58ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 1b496e1642bd385cdf195d85e7a4d3b0c2f7577eddd9bee54760d088eee8fb12 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Thu, 26 Mar 2020 16:14:20 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.25:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 6d84e94c-0f52-4be7-a2fb-02e79fab2258 Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
POST		auction tlx.3lift.com/header/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	727 B 1 KB	1194ms 62ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 6205459504e75c67e59747c213276b494531d30a2838ef52536e46397e4274a7 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Thu, 26 Mar 2020 16:14:20 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.116:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid e227f6e6-8d03-4514-bec8-bbc80b6b32ad Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 578 B	326ms 288ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=bad28273-208e-43e7-b40b-c6c930519df0%2Ca0a8a12d-d713-4312-a1ff-0e188fdbea55%2Cd2166630-067d-4cb7-ab6d-8fdb3119dbdf%2C825b5751-574a-406c-96db-f8002a112baa%2Cdf1b0f8b-8ad9-4db9-b46e-46fb188b150e%2C70be5549-80d2-458c-88ec-0103230306cd&nocache=1585239257620&pubcid=e56b8401-bd39-490b-bcda-5afc6ae92f0f&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%7C300x250%2C300x600&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250%2C540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 367c7f9fda96023743dae111f5e3ff2bf1c757a079da739a9e9f67b74299dbe3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:17 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 166 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST		v1 dmx.districtm.io/b/	0 0
POST		v1 dmx.districtm.io/b/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=109a3f73eb3aa67c;misc=1585239257623; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=110c264939ad8f2e;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=111fe4eb13fba59d;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=1125aa59ccd1f408;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=113c02224c992b6b;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=1140f31172b6dc4b;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=11518d0d5af87038;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=1167ecbecd2544b4;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=11753e4886bff04;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=11839b1ca293d702;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=119b29c2db192b5a;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=120784b0de6cd5f8;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=12151f299364bb82;misc=1585239257624; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	534 B 725 B	48ms 14ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 74b60f74d59ce780f3e5c7a68b8702a3f14ff7e19a03c9a8a246405e48c17e4e Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:17 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 534 expires 0
GET H2	200	aps_csm.js Show response c.amazon-adsystem.com/bao-csm/aps-comm/	6 KB 3 KB	251ms 42ms	XHR application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 05:55:25 GMT content-encoding gzip vary Origin age 37134 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 08:28:46 GMT server AmazonS3 access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 x-amz-cf-id C4Gb0U7_tncgE_oyTySwLa0ci4XztUNkPQv84lA-B1lMWK51dg19-Q==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	87ms 83ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&pid=XrJY4FOVTbWrC&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:17 GMT via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id mUeMcu4TWVzUHdMb--j3A3DL69Nw1Rr0ve0bqy4aT8-8D2XxPS_tkA==
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	225 KB 26 KB	682ms 636ms	XHR text/plain	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2746953219665089&correlator=618069853714455&output=ldjh&impl=fifs&adsid=NT&eid=21065764%2C21062797&vrg=2020032302&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_1x1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1%2C300x250%7C300x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1582664341&dt=1585239257997&dlt=1585239255440&idt=763&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C1082%2C1082%2C268%2C800%2C1082&adys=146%2C8272%2C327%2C1136%2C6841%2C8778%2C1661&adks=960084856%2C976516616%2C771041174%2C2389526111%2C4047242158%2C2635258439%2C523518761&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&dssz=60&icsg=2392538006716416&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C1200x90%7C306x250%7C306x250%7C834x90%7C1600x8779%7C306x250&msz=1170x90%7C1170x90%7C306x250%7C306x250%7C834x90%7C1600x1%7C306x250&ga_vid=645827379.1585239256&ga_sid=1585239257&ga_hid=1929598678&fws=4%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software cafe / Resource Hash 1d404cf108f7c6760154ae4f031e58ee5745ce2d42551ca5a8b6f41df811f0af Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:18 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 26429 x-xss-protection 0 google-lineitem-id -1,-2,-1,-1,-1,4893662829,-1 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -1,-2,-1,-1,-1,138254592126,-1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2020032302.js Show response securepubads.g.doubleclick.net/gpt/	67 KB 25 KB	76ms 32ms	Script text/javascript	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software sffe / Resource Hash a07183e063a79a699b732e200a3accdf4716cbc6e8bf8a6a709b9adba07d998d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:18 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Mar 2020 17:22:36 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 25234 x-xss-protection 0 expires Thu, 26 Mar 2020 16:14:18 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	31ms 6ms	Other text/html	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers
GET H/1.1	200 OK	p sb.scorecardresearch.com/ Frame 780C	43 B 309 B	29ms 26ms	Image image/gif	104.74.100.205 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585239257501&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=538&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=538&ns_st_dpt=538&ns_st_ipt=538&ns_st_et=538&ns_st_det=538&ns_st_upc=538&ns_st_dupc=538&ns_st_iupc=538&ns_st_upa=538&ns_st_dupa=538&ns_st_iupa=538&ns_st_lpc=538&ns_st_dlpc=538&ns_st_lpa=538&ns_st_dlpa=538&ns_st_pa=538&ns_ts=1585239258041&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c8=&c9=&cs_ucfr=0 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.74.100.205 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-74-100-205.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:18 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 44EF	200 KB 55 KB	41ms 15ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 44EF	200 KB 55 KB	38ms 13ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 44EF	16 KB 6 KB	37ms 13ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 44EF	92 KB 29 KB	31ms 7ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5284 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:14 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:14 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 44EF	3 KB 1 KB	54ms 30ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25792 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:26 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 44EF	46 KB 15 KB	50ms 26ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	css fonts.googleapis.com/ Frame 44EF	5 KB 1 KB	34ms 14ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET DATA	200 OK	truncated / Frame 44EF	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 83827c78a74d66a82fe1e36d92af9030c8284f6191d076c552d549535c92ecb1 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012003101714470/	20 KB 7 KB	20ms 19ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5232 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 7178 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:47:06 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "9d3d923337ef7e9b" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:47:06 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	60ms 59ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&pid=xPzOh6M1E9FK5&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:18 GMT via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id wkNrzx51q_o7fpll92xRSGdw5sodEXiKo7JMXHuvoDjzYnVrBlintg==
GET H2	204	l www.google.com/ads/measurement/ Frame 44EF	0 0	49ms 16ms	Image text/html	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaR70bKiMYyAQ-Q-PlrRrfib1aDJADT9-YgJTZBMPoNVVOZDSzthb3KEMy24YmKPNpiB37OU-Z9cdzJAd8jN0unTkxll-Q Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 44EF	0 0	38ms 38ms	Image text/html	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CGSgx2tR8XvOBC5iU3wP5zKroAq7W1YdajZXfhrAKwaGPlQEQASDHg_wBYLnovoDUAaABj5SzlwPIAQHgAgCoAwHIAwqqBK4CT9AoSsEqMGOBiLpl9n1CYgpyRpiSlUz0D5dRwD9Estti2IOjsQpdgbBnsPh9eDL1hhCnaGiTJFSPKlzz6ZJq3f_DSB7BcB9YyQGp8zfcPujfGljwtAfgLq4vZRY32IQ17t7J-LlHK54QiKo3uCuKEAxDRXhkx64k_8MLaMLd9_peeWysX0ieDdNFd8P8C3RwdJxTT1WT2IBfdhcB5LvSWBnClVNscBDZS8Rt6fSFBHdVP0OsDlPxtqP7Gf8m2xD7KrI3pkKtr2eNeWz14x4Bhyw83qu4EkmEtDAhBgS0bztJbGN-kzN0YdZ5gFa8-WSwW1g9bd2_5Sm5Ylz6OJfS2AC6_YsmGvsVbf7I16oJOUwlu2LcxYHNCuTUUfFGwE9RHn0o2l-zTNA9Zu6ofF3ABLvCzaG0AuAEAZIFBAgEGAGSBQQIBRgEgAfZ68xoqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQ0agJ0ggJCIDhgBAQARgdgAoByAsB2BMCiBQD&sigh=eqOHLyEzJ9E&tpd=AGWhJmu7HInRFrb6P_P5MsTEjRbAx2nh3a5fVtNcmQDaI1JDBA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame C24F	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame C24F	200 KB 55 KB	17ms 16ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame C24F	16 KB 6 KB	24ms 23ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame C24F	92 KB 28 KB	20ms 19ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5284 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:14 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:14 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame C24F	3 KB 1 KB	16ms 15ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25792 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:26 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame C24F	46 KB 15 KB	23ms 22ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	css fonts.googleapis.com/ Frame C24F	5 KB 718 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET H2	200	css fonts.googleapis.com/ Frame C24F	5 KB 718 B	18ms 18ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET DATA	200 OK	truncated / Frame C24F	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5ac36d76fd65e0359fbcd1e5d93967a315cac8cf970978d8a5eb97eac9310ef5 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame CDDE	200 KB 55 KB	12ms 6ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame CDDE	200 KB 55 KB	24ms 18ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame CDDE	16 KB 6 KB	23ms 17ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame CDDE	92 KB 28 KB	21ms 15ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5284 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:14 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:14 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame CDDE	3 KB 1 KB	21ms 14ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25792 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:26 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame CDDE	46 KB 15 KB	25ms 18ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	css fonts.googleapis.com/ Frame CDDE	7 KB 781 B	25ms 8ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame CDDE	20 KB 20 KB	14ms 0ms	Image image/png	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f66ce8818b0fb57525e8959a33853b4dc6b4abaa0c7fe9de544a7ef44ed02a8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 24 Feb 2020 19:27:17 GMT x-content-type-options nosniff age 2666821 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 20559 x-xss-protection 0 last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 23 Feb 2021 19:27:17 GMT
GET DATA	200 OK	truncated / Frame CDDE	209 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame CDDE	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b69f626090052ff8b8958f69315c553b5b543edcd3984f2c741f38a0f5b2223b Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame F0E5	200 KB 55 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame F0E5	200 KB 55 KB	9ms 6ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame F0E5	16 KB 6 KB	12ms 8ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame F0E5	92 KB 28 KB	14ms 10ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5284 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:14 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:14 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame F0E5	3 KB 1 KB	13ms 9ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25792 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:26 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame F0E5	46 KB 15 KB	12ms 8ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	css fonts.googleapis.com/ Frame F0E5	5 KB 718 B	17ms 14ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET H2	200	css fonts.googleapis.com/ Frame F0E5	5 KB 718 B	18ms 15ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 16:14:18 GMT server ESF date Thu, 26 Mar 2020 16:14:18 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 16:14:18 GMT
GET DATA	200 OK	truncated / Frame F0E5	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 22ddfb0fbd2c4566049826b313cc76d922b80f7fc037d44ecc406839cf204788 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame D7EB	0 0	36ms 35ms	Fetch image/gif	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuHeEjQrjgDJTYgCjTTz0JoUApGhF0Ipwo0IiLgFE8p1h_rGyMOKrix6XHgiFj0EjzkgcbUgzoj16nr2sgnRHwzjoYUFWFHabREtf3aczqaeDeF6xUK8m0qb1dleCN-0BnASGDMUKQvU-aat5H35x3NIkq-THjF60H7mzC1990e9OK74osbtLFvS3z9ESheRSt299ksuN0NgkCKhRtPjnxX-Luz_XEz0dbjvwYQYC-Hb1idEhwLfM5vDdYyNT31DxYt9SnTTSAEN3saWxYXqGQd9tXpP0dgSAl&sig=Cg0ArKJSzHuV0juyDUPkEAE&urlfix=1&adurl= Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers timing-allow-origin * date Thu, 26 Mar 2020 16:14:18 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 0 x-xss-protection 0
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame D7EB	74 KB 28 KB	41ms 40ms	Script text/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 16:14:18 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1585165059237800" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28264 x-xss-protection 0 expires Thu, 26 Mar 2020 16:14:18 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 84C1	200 KB 55 KB	9ms 8ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 84C1	200 KB 55 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5270 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:28 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 84C1	16 KB 6 KB	16ms 15ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 84C1	92 KB 28 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5284 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 14:46:14 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 14:46:14 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 84C1	3 KB 1 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25792 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:26 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 84C1	46 KB 15 KB	10ms 10ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 25791 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 09:04:27 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 09:04:27 GMT
GET DATA	200 OK	truncated / Frame 84C1	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash da5a5c848db9474c3100e09c5b56fa4e533584796405e25861c8f1c8c5e9b926 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	10692877860909471138 tpc.googlesyndication.com/daca_images/simgad/ Frame C24F	84 KB 84 KB	10ms 9ms	Image image/jpeg	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/10692877860909471138 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e3ea7c5aad8d1cd53b23c9f7f4f37eacf60c1e1aebe90baf6080510695376973 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 03:36:23 GMT x-content-type-options nosniff age 1773475 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 86274 x-xss-protection 0 last-modified Wed, 08 Feb 2017 19:29:49 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 03:36:23 GMT
GET H2	200	40933678460698624 tpc.googlesyndication.com/simgad/ Frame C24F	1 KB 859 B	9ms 9ms	Image image/svg+xml	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/40933678460698624 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Sun, 22 Mar 2020 12:03:30 GMT content-encoding gzip x-content-type-options nosniff age 360648 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 728 x-xss-protection 0 last-modified Thu, 26 Oct 2017 18:18:20 GMT server sffe vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 22 Mar 2021 12:03:30 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame C24F	0 0	33ms 33ms	Image text/html	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CWPHx2tR8XqWGC5iU3wP5zKroAobCyoFWsdT18_MKwI23ARABINrXxTlguei-gNQBoAH8p9zmAsgBAakCyK2YOo5isj7gAgCoAwHIAwqqBLsCT9DyPmFBWRmdW7vqiv8n4_Ge3PQSTb6k3Ggd1G1eEnC2SJ1XAqK6ZQErDMZ8yta6fLtC7vgt_Y1uuezXBmAAmjVj-i-YDANc8QoZ1SXUhrWe-hn2DvL_5DodS4iR1SLBGvQiGLuUJSyF3sm7DnND4Gp8ZehSnBxXPNpgVjCNzTqRL5MIQJbulmwlzpVbCqOqcoy6x7CkQDXcEwI739We9w6lIVLaulXRulvYm48zwvlxpC9MCWCb4Ph8lIxmtayLpGGi9r4T9mSFMZXcyazbcS8yQQAbwKBKzrd-dLjdCcGkn8mVk9TH2M0HjYOdEDxHzSYBVQUuLgDhOm6cgnWwEq5_ei_hZ4_PV6bV61F79IaGeolnVntpk_pB6tKSjyD6L4AQLvhqx4pxCukaRfkTFp_PgHHCXZNXQ255wAT5hvzRhQLgBAGSBQQIBBgBkgUECAUYBKAGUYAH7NejmQGoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCguQzSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTE3NDIyNDk2MDMyODkwODOACgPICwHYEwo&sigh=d7quHY5oe6k&tpd=AGWhJmsdHu2K7dF1jZsrnDQskEDOnL1h2SMqKtwSlEcuaObFxg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame CDDE	0 0	16ms 11ms	Image text/html	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRXpgOo3xfyf2xFIHp5Bk8dRga-3-u8rDKGmvfG8L2lUjdlVD0jMJ5TKb8jv4Mttdga0sQSVH0lAdoZP_uUGmZXagcmTw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame CDDE	0 0	42ms 32ms	Image text/html	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CiR_-2tR8XqqIC5iU3wP5zKroAq7W1YdajZXfhrAKwaGPlQEQASDHg_wBYLnovoDUAaABj5SzlwPIAQngAgCoAwHIAwqqBLQCT9BOdrN4RH7l6yOfGvog3fysjYT_H-kJFooqR6fu2wuGosX5_TZQmAJTlaX0d66SrGI77kYFGoe065ViFmocTgKb158kZ7uAkIL2UnZHYMem9yi2w8-jb62bY6iWT_mQibF-MdgrNkSVm6L5d3bG_FU6ZP9yS3Fa-3BGUpygOHMGuJ-Su4pxA-DPfFVGLuGOAGk0vYaotf-FUasbmAlVVY6hvGO18uITLPP_SrakUbmspSioD6eTUsNELE1ebDeBwwGpiIDAk2GiEUljnFOAFEMMTehNny5aNlFUPjJEQ4Ku_f4WgKpR-rf2iIku0GTUpLot1KzidZ-yM3D29eI0MgpCpgt1Q3tJIQT6P7TXr8D2GVEYxQjuOovRNldfWbJ9YZx8TW7MOSiNT2EzXS18lv8VK1DABLvCzaG0AuAEAZIFBAgEGAGSBQQIBRgEoAYugAfZ68xoqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwDyBwQQ4osI0ggJCIDhgBAQARgdgAoByAsB2BMCiBQD&sigh=KPQC9epXZY4&template_id=5000&tpd=AGWhJmuGtGXzJGT2SlEOOqNIQ_Y3DIY-41zRRGfjU8z-avmBbQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	6561121273577517464 tpc.googlesyndication.com/daca_images/simgad/ Frame F0E5	66 KB 66 KB	16ms 6ms	Image image/jpeg	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/6561121273577517464 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2380c72eb40c754b286066e38e1cec20d9e1c56053c5bb5b9bb36edfe161116c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 10 Mar 2020 19:36:14 GMT x-content-type-options nosniff age 1370284 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 67754 x-xss-protection 0 last-modified Wed, 08 Feb 2017 19:29:18 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 10 Mar 2021 19:36:14 GMT
GET H2	200	40933678460698624 tpc.googlesyndication.com/simgad/ Frame F0E5	1 KB 791 B	14ms 12ms	Image image/svg+xml	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/40933678460698624 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Sun, 22 Mar 2020 12:03:30 GMT content-encoding gzip x-content-type-options nosniff age 360648 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 728 x-xss-protection 0 last-modified Thu, 26 Oct 2017 18:18:20 GMT server sffe vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 22 Mar 2021 12:03:30 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame F0E5	0 0	42ms 33ms	Image text/html	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=Cr2jx2tR8Xp2KC5iU3wP5zKroAobCyoFWsdT18_MKwI23ARABINrXxTlguei-gNQBoAH8p9zmAsgBAakCyK2YOo5isj7gAgCoAwHIAwqqBLcCT9ATegHH-X8nlnJmy40OnLgruaGYftCfCSD-XPJs5EVr26KQS6oIUnSftussfUGjreaVUsgnr0pmTHclNdol8VUxdNnc-RgC7gGS2XcbRYUU3bXdk3-Pkqpim1uu_zCW5ckCV74BfPj64xhUWSjpX3WuVXbBr2cQppC6gRf0Tv0zukVZJqcxFESFqWvl65R8pc9DJrDlsR_Xg9Evr3-LLOd8vBpbNL-RnkLb2TBIw4DF2DndDx_nbvXyL3tPler9u4g7sqaVfW8Cs1vsUPl0ev04McpyQcY4foc1PWoFLbvMHKPYmvMsC_sCUAQlMM5ZLOw1R3Wa3_P7K8QdRy2bv17S2ahobNehSYe3iutRY2WRArSGxZgo-31mqv6J2HGoLq-EglohUwWhOBjM4pt-YzH0an96SePABPmG_NGFAuAEAZIFBAgEGAGSBQQIBRgEoAZRgAfs16OZAagHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEN3wBNIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTCg&sigh=IGXZ9Eb725E&tpd=AGWhJmuD_RB6YeBuvOADaGL0-UOK7qvziGQbt47MWQRGhieTIQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame F0E5	0 0	26ms 12ms	Image text/html	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRGqNrEabBmDSQYImOp_2AGjaLDysq8jWSoKgcqKnHzrmxrt7IbvuE_vzeQJNz0iqZAhCWiHhb9HwPtxNgFCF1ALRDsVQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	6951295453056711821 tpc.googlesyndication.com/simgad/ Frame 84C1	25 KB 25 KB	20ms 10ms	Image image/png	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/6951295453056711821?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qluB7oq5--nTzclWhpFVjBoW4FDNg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 622dc086ab7cfc6703e4d9b075810401db133949c90ff47baa836d765083fa57 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 16 Mar 2020 09:33:17 GMT x-content-type-options nosniff last-modified Wed, 08 May 2019 00:42:50 GMT server sffe age 888061 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 25723 x-xss-protection 0 expires Tue, 16 Mar 2021 09:33:17 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 84C1	0 0	27ms 13ms	Image text/html	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaT5RuI1GzqnFZTY3GkMLay9QtJw7uV7JsA5HTgWD1W2-xBrAGA8paKd256x8k4jKP9b259ERycSEh8a2cvEguHiaxG6OQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 84C1	0 0	44ms 30ms	Image text/html	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CY_hJ2tR8XpyMC5iU3wP5zKroAoDcqqdc1fL5rpIJj4-85rQJEAEgx4P8AWC56L6A1AGgAbS84vsDyAEC4AIAqAMByAMIqgS7Ak_QnXYWuxnX8fXzWb3xQOTup3MC13QhhnmbZK88JwBq2rBUKqVeedTwLiMu_2Dt_3jaToyOBZn8IPw-IS_fTLp8uNU24aRcxsc5GB0-ehAnHot4ylzqZYFTQoAEZq0fhi2jbR0cjKSj6kk0M-MGxQ8cQVJOX2Sle7IqP2GPeyHqU2aDq3TOHSzPZ6GuPEyfbFf31hJ9o1nQU8AH6usvwvU7ZjTeX29qQcz9badOioSrfFzUs7ni-kvicey_bjaHuEfVKB77ctaZYartmASKpzO9mNSQfGsAyVGrFhknwUA7MQI84BXE5kEBUdtL2fb92D1ktBInW9Go1VX4eddTWfkNwrSP4gDUt82pjdixuv3L84xKpE4mtr0W8dLNaEvaMJ0xgl_Ue0SdfVG9ibFCJiXa7_c30L7txnkbwsAEo__Vy48C4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB7TDnQSoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBD1wwXSCAkIgOGAEBABGB2ACgHICwHYEww&sigh=03Kn25GVX50&tpd=AGWhJmt9zKqI6JSCymB2JkVT_oqK86KUWlEebeV9YYKVoXSYDw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
POST H2	204	v1 Show response dmx.districtm.io/b/	0 262 B	74ms 25ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 16:14:18 GMT server cloudflare cf-ray 57a229f86dabd8cd-AMS expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		cygnus as-sec.casalemedia.com/	0 0
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 371 B	218ms 217ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=3ffea015-31da-4efa-a122-d53711d5807a&nocache=1585239258897&pubcid=e56b8401-bd39-490b-bcda-5afc6ae92f0f&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash eeba5bc7c7d1bd08398a303f630d00117ceb322a2f5263b6a09c58c087acb6f6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:19 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST		auction tlx.3lift.com/header/	0 0
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 4b6ac65439ea16ec281045202f5a2b7569a717f2b8363a8e83907f81bb70adfd Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:18 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	88ms 88ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 04b6f0c99bd600dfe5fa30faf5fb3ad40a3c9c65a49508c9a737a77d301a75b5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.198:80 AN-X-Request-Uuid 69f3372e-2bf2-4f34-838d-0b94ca623f02 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=15445cb8e7835ccb;misc=1585239258900; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=1555ef52885338c4;misc=1585239258900; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=15604b990a91223d;misc=1585239258900; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	92ms 77ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 646038705e2e7d8c601b11aa1906432eeb2eb1210afa678b293fe4e408d6a968 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.228:80 AN-X-Request-Uuid 287ee5eb-c645-4dd7-b4d2-dd1b736fad87 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 44EF	11 KB 11 KB	43ms 21ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1861299 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 44EF	11 KB 11 KB	36ms 15ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2446032 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame C24F	11 KB 11 KB	35ms 16ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2446032 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame C24F	11 KB 11 KB	36ms 18ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1861299 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame CDDE	11 KB 11 KB	24ms 10ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1861299 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame CDDE	11 KB 11 KB	34ms 20ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1860780 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame CDDE	11 KB 11 KB	25ms 10ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2446032 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame F0E5	11 KB 11 KB	25ms 16ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2446032 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame F0E5	11 KB 11 KB	29ms 20ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1861299 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	486ms 117ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 4df5dc7bd2f3217461c80bcf4d2579f1874084511bacbdfd47dadcdad5814a83 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:19 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame C24F Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	43ms 43ms	Image text/html	2a00:1450:4001:81e::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Thu, 26 Mar 2020 16:14:19 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 44EF Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	41ms 41ms	Image text/html	2a00:1450:4001:81e::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Thu, 26 Mar 2020 16:14:19 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame F0E5 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 38ms	Image text/html	2a00:1450:4001:81e::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Thu, 26 Mar 2020 16:14:19 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 84C1 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	48ms 47ms	Image text/html	2a00:1450:4001:81e::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Thu, 26 Mar 2020 16:14:19 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	10692877860909471138 tpc.googlesyndication.com/daca_images/simgad/ Frame C24F	84 KB 84 KB	6ms 6ms	Image image/jpeg	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/10692877860909471138 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e3ea7c5aad8d1cd53b23c9f7f4f37eacf60c1e1aebe90baf6080510695376973 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 03:36:23 GMT x-content-type-options nosniff age 1773476 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 86274 x-xss-protection 0 last-modified Wed, 08 Feb 2017 19:29:49 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 03:36:23 GMT
GET H2	200	40933678460698624 tpc.googlesyndication.com/simgad/ Frame C24F	1 KB 797 B	7ms 7ms	Image image/svg+xml	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/40933678460698624 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Sun, 22 Mar 2020 12:03:30 GMT content-encoding gzip x-content-type-options nosniff age 360649 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 728 x-xss-protection 0 last-modified Thu, 26 Oct 2017 18:18:20 GMT server sffe vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 22 Mar 2021 12:03:30 GMT
GET H2	200	6561121273577517464 tpc.googlesyndication.com/daca_images/simgad/ Frame F0E5	66 KB 66 KB	16ms 5ms	Image image/jpeg	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/6561121273577517464 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2380c72eb40c754b286066e38e1cec20d9e1c56053c5bb5b9bb36edfe161116c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 10 Mar 2020 19:36:14 GMT x-content-type-options nosniff age 1370285 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 67754 x-xss-protection 0 last-modified Wed, 08 Feb 2017 19:29:18 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 10 Mar 2021 19:36:14 GMT
GET H2	200	40933678460698624 tpc.googlesyndication.com/simgad/ Frame F0E5	1 KB 791 B	17ms 7ms	Image image/svg+xml	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/40933678460698624 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Sun, 22 Mar 2020 12:03:30 GMT content-encoding gzip x-content-type-options nosniff age 360649 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 728 x-xss-protection 0 last-modified Thu, 26 Oct 2017 18:18:20 GMT server sffe vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 22 Mar 2021 12:03:30 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	242ms 132ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 4df5dc7bd2f3217461c80bcf4d2579f1874084511bacbdfd47dadcdad5814a83 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:19 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202003251303/	106 KB 36 KB	22ms 22ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 563e810f9f335949b38eb56ca70a8b7e17d4bc5e4a897883e945260f929a086f Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 16:14:19 GMT Content-Encoding gzip Age 584 X-Cache HIT Connection keep-alive Content-Length 36363 x-amz-id-2 VnN1SNOYsVs92+0IzHs6Lgtrwjfxav1EwahlKGmdhRvBdVzr20jF/cOsW54DbI+/Mmw3DaIicJc= X-Served-By cache-fra19152-FRA Last-Modified Wed, 25 Mar 2020 19:34:39 GMT Server AmazonS3 X-Timer S1585239260.840295,VS0,VE0 ETag "a7a4d991ef5cb3b6afa336418179b5b1" x-amz-request-id 2D6FCBC0DCEC9A68 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 224
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202003251304/	33 KB 13 KB	53ms 22ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202003251304/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 44cf43205b3b0b693b2696606c8b06f28da542a23a10ff3cd346ff529a7cd60c Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 16:14:19 GMT Content-Encoding gzip Age 584 X-Cache HIT Connection keep-alive Content-Length 12471 x-amz-id-2 LowYjSOTvDSrWk7QQHe2tuFri2wPgOkkEC0Nm1Gg2VVfdMeDfZ+elruyAnTc5KqvrODyDfgS2Wo= X-Served-By cache-fra19152-FRA Last-Modified Wed, 25 Mar 2020 19:34:40 GMT Server AmazonS3 X-Timer S1585239260.871289,VS0,VE0 ETag "27c6e6819d441fd68b0821499dea8b13" x-amz-request-id B2D87ACED3229309 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 152
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 44EF	42 B 291 B	38ms 37ms	Image image/gif	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZ2Y05wi9i0SR3Osh2Hhk8GgPnQre6m04rRIw_UpUVSWvqrD-nudvtkakuXvSxpRCWy7WntOJq2Qg7V3S-3elgHC1b05FSOJkppynNK0CLBoNa6t6Xn_HNiGOopA&sai=AMfl-YQPRCGdqFjxxqwQZb2bVmnLdQlls-lZqZjJgmQ7prJp2YlVt_d26OZPV1QmL7qsEW2gwbcMP_5LwJEZpgKoMzaJ9ogkEIMF_aa8csBS3Zb9HZlZ0thQDF_x6vFM&sig=Cg0ArKJSzBiYtGUi8WPNEAE&cid=CAASF-RoVypWCJH2U4L3BZ4sKDxoZXu4IEQU&id=ampim&o=315,146&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=265&tls=1265&g=100&h=100&tt=1265&r=v&adk=960084856&avms=ampa Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:20 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame C24F	42 B 110 B	62ms 61ms	Image image/gif	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuWxrfFij3KoY8N1Jgucsrpk3eaRkaZ1qBS-X_sbsnEMV3pSERMtZUBHTIla7oP1HlZLb-awxEO8zpnsy8xhVEdFIP86X0cRVimCUgL3VAPqsHN9Y37QCRvbVNCtA&sai=AMfl-YTGnYVsSxMpHgNoQYK3IUTjaZkm8TrhRDTlUiMNokpVJByx0JFhUEwQd2oiZDSAihxeCKlH4U0mq0Dj3jKIGkgGTpkowVDYJYkZzNnIGklMhUGy8DKH81gbuV-f&sig=Cg0ArKJSzA0QrHZ7I8O4EAE&cid=CAASF-RoIeKiALIOjPIJpUDfQaaWNW5JwpnA&id=ampim&o=1082,327&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=335&tls=1335&g=100&h=100&tt=1336&r=v&adk=771041174&avms=ampa Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:20 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 240 B	217ms 216ms	XHR text/plain	172.217.22.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2746953219665089&correlator=618069853714455&output=ldjh&impl=fifs&adsid=NT&eid=21065764%2C21062797&vrg=2020032302&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3De5ae9a9312f89647%3AT%3D1585239258%3AS%3DALNI_MZVgFGyCuEeI8fHgNpmnAYn386j4w&cookie_enabled=1&bc=31&abxe=1&lmt=1582664341&dt=1585239260440&dlt=1585239255440&idt=763&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=8272&adks=976516616&ucis=8&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&dssz=56&icsg=2392538006716416&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x90&msz=1170x90&psts=ABP-KfRqP4xsXquiHopBn8gOoBESIqmKJMaTwBxlqv7qJADx85Sw4hf0z_EbOQcFU-deZZRFbDKEOIEQmSIY&ga_vid=645827379.1585239256&ga_sid=1585239257&ga_hid=1929598678&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032302.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.2 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s14-in-f2.1e100.net Software cafe / Resource Hash 0ba927d4011723a0f4ed414f9e44c6688d26bcfac19beeb8c0f0b53b7fd80620 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:20 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 151 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	117ms 117ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 4df5dc7bd2f3217461c80bcf4d2579f1874084511bacbdfd47dadcdad5814a83 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:21 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame CE9E	0 0	66ms 22ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie uuid2=4257731231086777261; icu=ChgIodc0EAoYASABKAEw3Knz8wU4AUABSAEKGAiF5V4QChgBIAEoATDcqfPzBTgBQAFIARDcqfPzBRgB Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Thu, 26 Mar 2020 16:14:24 GMT Age 20154750 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19133-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 309060 X-Timer S1585239265.988408,VS0,VE0 Vary Accept-Encoding
GET H2	200	sync eb2.3lift.com/ Frame ED84 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	21ms 21ms	Document text/html	3.127.164.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.127.164.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-164-217.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 date Thu, 26 Mar 2020 16:14:25 GMT content-type text/html; charset=utf-8 content-length 0 cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 16:14:24 GMT content-length 0 set-cookie tluid=11331974024666440964; Max-Age=7776000; Expires=Wed, 24 Jun 2020 16:14:24 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	204	index.html cdn.districtm.io/ids/ Frame 222F	0 0	29ms 27ms	Document text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 204 date Thu, 26 Mar 2020 16:14:24 GMT set-cookie __cfduid=d0cae5c39473f8b71610dbfe56360bb141585239264; expires=Sat, 25-Apr-20 16:14:24 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a22a1defded8cd-AMS
GET H2	200	sync eb2.3lift.com/ Frame A3C2 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	21ms 20ms	Document text/html	3.127.164.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.127.164.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-164-217.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 date Thu, 26 Mar 2020 16:14:25 GMT content-type text/html; charset=utf-8 content-length 0 cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 16:14:24 GMT content-length 0 set-cookie tluid=16242790533195570198; Max-Age=7776000; Expires=Wed, 24 Jun 2020 16:14:24 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame CA38	0 0	29ms 28ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US cookie i=e56b8401-bd39-490b-bcda-5afc6ae92f0f|1585239257 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=e56b8401-bd39-490b-bcda-5afc6ae92f0f|1585239257; Version=1; Expires=Fri, 26-Mar-2021 16:14:24 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585239264|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 16:14:24 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 16:14:24 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame A0E3	0 0	28ms 27ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US cookie i=e56b8401-bd39-490b-bcda-5afc6ae92f0f|1585239257 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=e56b8401-bd39-490b-bcda-5afc6ae92f0f|1585239257; Version=1; Expires=Fri, 26-Mar-2021 16:14:24 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585239264|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 16:14:24 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 16:14:24 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear
GET H2	204	index.html cdn.districtm.io/ids/ Frame 4C88	0 0	29ms 28ms	Document text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers status 204 date Thu, 26 Mar 2020 16:14:24 GMT set-cookie __cfduid=d0cae5c39473f8b71610dbfe56360bb141585239264; expires=Sat, 25-Apr-20 16:14:24 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a22a1dfff2d8cd-AMS
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame EC25	0 0	81ms 23ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie uuid2=4257731231086777261; icu=ChgIodc0EAoYASABKAEw3Knz8wU4AUABSAEKGAiF5V4QChgBIAEoATDcqfPzBTgBQAFIARDcqfPzBRgB Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Thu, 26 Mar 2020 16:14:25 GMT Age 20154750 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19133-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 309061 X-Timer S1585239265.012208,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame AE80	0 0	311ms 20ms	Document text/html	23.8.15.54 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.15.54 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-8-15-54.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Wed, 04 Mar 2020 22:48:14 GMT Content-Encoding gzip Content-Length 7619 Content-Type text/html; charset=UTF-8 Cache-Control max-age=51232 Expires Fri, 27 Mar 2020 06:28:17 GMT Date Thu, 26 Mar 2020 16:14:25 GMT Connection keep-alive Vary Accept-Encoding
GET H/1.1	200 OK	g Show response rtb.connatix.com/	113 B 306 B	133ms 132ms	Script text/plain	54.83.128.233 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c_ivt=0&connatix_sess=YxihGX2DSsDXPD6b-rBYFT_9Xge-CkAeXDJaxOM1U9LYM5IqaB0AzYV8_218Q7J2JQh6ODOXzFy0OxY_RFvtpiuOocnD6B-UN5m9T6o1Far7Nr3FOvL6SCiqPOs5ByYVWnYdm4schs-K-14On3W2wrKLDi68V0WHyZ0JRcDtpbIDj_bsW11xTDbAgaw-lmd2&notServed=false&xplr=true&c_s=false&c_pl=hD4ZTGW05hXngzjDGJhWu9YJwvHGndlV7X-XiKpmbpOLZqPXLv-1aWFWIFhHQ4Ss26CLJhIHsj3HY3k3TkRx4II6_yoqR0xuYIQIWXiJSmrJEqN6owqxrmKT1uYNvuJ8GWXCqvpTavnhjkIvLnkbHjU-_4VwZ4yTwcoc1gUlBR4S65F5Pfc6-1MNRyLNSCMxmlIKQiFBJZzBjqHvgRneex1Ovp9zxltEtYOY80e13ACawZwUZBO8vylfDrUl8Zhp-hTpXUNiBoOw9nWYnnHXRw&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=2&v=1&c_pt=1&c_f=[{id:14547,r:4,i:0,f:2.73},{id:16156,r:1,i:0}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_c00691bffed057e8c5e21585239267473 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.83.128.233 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-83-128-233.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash f4ed273e96ef29323029d8d32dfa2bb1f142c2ada426f98c56982894a0092168 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 16:14:27 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 118
GET H/1.1	200 OK	g Show response rtb.connatix.com/	95 B 298 B	114ms 114ms	Script text/plain	54.83.128.233 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&c_ivt=0&connatix_sess=YxihGX2DSsDXPD6b-rBYFT_9Xge-CkAeXDJaxOM1U9LYM5IqaB0AzYV8_218Q7J2JQh6ODOXzFy0OxY_RFvtpiuOocnD6B-UN5m9T6o1Far7Nr3FOvL6SCiqPOs5ByYVWnYdm4schs-K-14On3W2wrKLDi68V0WHyZ0JRcDtpbIDj_bsW11xTDbAgaw-lmd2&notServed=false&xplr=true&c_s=false&c_pl=hD4ZTGW05hXngzjDGJhWu9YJwvHGndlV7X-XiKpmbpOLZqPXLv-1aWFWIFhHQ4Ss26CLJhIHsj3HY3k3TkRx4II6_yoqR0xuYIQIWXiJSmrJEqN6owqxrmKT1uYNvuJ8GWXCqvpTavnhjkIvLnkbHjU-_4VwZ4yTwcoc1gUlBR4S65F5Pfc6-1MNRyLNSCMxmlIKQiFBJZzBjqHvgRneex1Ovp9zxltEtYOY80e13ACawZwUZBO8vylfDrUl8Zhp-hTpXUNiBoOw9nWYnnHXRw&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=3&v=1&c_pt=1&c_f=[{id:14547,r:7,i:0,f:2.73},{id:16156,r:2,i:0}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_39fd237606638275e0861585239282500 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.83.128.233 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-83-128-233.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash f219a549176bee655c0ce761abafbe927ef818094c1e5f10e924eb4b9caf2b22 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 16:14:42 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 110
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	129ms 118ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 16:14:46 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 377 B	88ms 87ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&pid=Er0XllkTyP0Cn&cb=2&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:46 GMT via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id RNdEwIpbMCFpGi5GIBM3KTxLZw4INr_Ffp9FlF7jjM72FTgD-n-jvA==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	75ms 75ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&pid=x14T23zlbemKZ&cb=3&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:14:46 GMT via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id E0VXY39ORAF2cgCQRY0oL_q31ePDv8rLrVBxtnBkzDGlv_69srDHyQ==
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	132ms 77ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 4de4dc0f3a5e6893bc3fef975784e8514bfff72957ec27a2da02e853904e3c50 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:48 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.205:80 AN-X-Request-Uuid 742365df-eb1a-4e77-ba48-5162c3222783 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 482 B	148ms 106ms	XHR application/json	52.58.202.213 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.202.213 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-202-213.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 161 B	26ms 26ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 16:14:46 GMT server cloudflare cf-ray 57a22aa5784ad8cd-AMS expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 367 B	160ms 146ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=2d4d04af-0b2c-4db0-bbe3-1092f3fbd1d1&nocache=1585239286632&pubcid=1c76fe4a-5ef3-48d4-9a9a-f6a68d0a71fc&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 56a8a79059a7814e26a17c506c948cf85dd613db0e2180fa8c0ce460a9f22488 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	181ms 105ms	XHR application/json	69.173.144.143 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=2d4d04af-0b2c-4db0-bbe3-1092f3fbd1d1&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.859664974109231 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 8e01014b660d1ca17b6f67c39ba5f9773e278befd5ab360ce0ac62e9d365a598 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:46 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=451 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 998 B	395ms 347ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2218361df5689b1011%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22184607cb0e7b41e1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22185619cd6c07e60c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221864cc3f09a472ca%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 3697d968115bca78912bfb17ea70a10f73d22155aa2fdd9105744e05c1c3f76c Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:47 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Thu, 26 Mar 2020 16:14:47 GMT
GET H2	302	ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635	0 -1 B	404ms 343ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635	0 -1 B	405ms 344ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635	0 -1 B	404ms 343ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	106ms 52ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 34269d2c3ded538f412f7fa3005a041fa5e1594cfed9d31573f9c077d30fa937 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:48 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.123:80 AN-X-Request-Uuid 210d8f29-de59-40dc-bf45-7c8077002654 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	15ms 13ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 32f46c83fd6cb8904f745f15cf3d93935d968cdc6a9a82f7581972812783b3f6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:46 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
GET H2	302	ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=15...	0 -1 B	368ms 367ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1...	0 -1 B	341ms 340ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1...	0 -1 B	365ms 363ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET		ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET H2	200	ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	606 B 762 B	188ms 186ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ae99232c4-6f7c-11ea-b3d4-121c10c2940c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=19805e3c046e8ef;misc=1585239286635 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 04cec8faeaf41c8d505dac510236d4f83f64b45361d3de6b1270c241a7ab915c Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	42ms 41ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 48eb6ee06e3346af00f927fc70a30ca8959bb7832e89597b1ee7addcd1779f74 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:49 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.229:80 AN-X-Request-Uuid 6f6ef628-fb12-43a0-9d1b-1344b4094ce0 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	53ms 53ms	XHR application/json	37.252.173.27 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 51b0dc56c3a140fea8acf36311f8ed8b8778243b8a19b57e50a47ec2cf6ff529 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 16:14:49 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.39:80 AN-X-Request-Uuid 87639e70-e0d3-40ad-a9e8-a6a8fd93161e Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=231897c1c0e4bc99;misc=1585239287619; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=2322bb98ee6d8376;misc=1585239287619; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
POST H2	204	v1 Show response dmx.districtm.io/b/	0 162 B	25ms 24ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 16:14:47 GMT server cloudflare cf-ray 57a22aabbcb0d8cd-AMS expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET		arj freestar-d.openx.net/w/1.0/	0 0
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	192 B 382 B	17ms 16ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash a84eb7efe9f03a44b7101b1acb9264590e5acde7b82b85c1f81a6ea28a404d6d Request headers Referer https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 16:14:47 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 192 expires 0
GET		cygnus as-sec.casalemedia.com/	0 0
POST		auction tlx.3lift.com/header/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ad-delivery.net

URL

https://ad-delivery.net/px.gif?ch=1&e=0.45386931681126197

Domain

vid.springserve.com

URL

https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=

Domain

as-sec.casalemedia.com

URL

https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22540c216c7c05a7%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2262bbfee02a81a4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2271304ccf0f203%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22891bbc15201fff%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229e025bcc535e03%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2210fcbf651a4240f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22110efb4024c32f1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2212e460042c48b06%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22134a6ae141e3a07%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2214cd6ab8c6c0157%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2215df761ab0ec01%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2216f65eb1c88435%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2217e8a2c78314f0a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22187b5b40cb4e738%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=bad28273-208e-43e7-b40b-c6c930519df0&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7041726110895736

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=a0a8a12d-d713-4312-a1ff-0e188fdbea55&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8594318958203182

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=d2166630-067d-4cb7-ab6d-8fdb3119dbdf&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6029535467314453

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=825b5751-574a-406c-96db-f8002a112baa&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.0018813936694421773

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=df1b0f8b-8ad9-4db9-b46e-46fb188b150e&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.3393194437913669

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=70be5549-80d2-458c-88ec-0103230306cd&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6757786247637201

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=27fa45fc8dd4518&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=28d9b7dd80d6586&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=29acf67f1e089fb&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=30dcbdb153f8528&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=31e323f126d00ef&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=32aae92f2aeee15&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=334d4ad80900459&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=34092cf5dd1ee27&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=35ba1f7bfcf2e83&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=36855f186cd99ff&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=37688720af8eb97&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

tlx.3lift.com

URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tmax=1200

Domain

dmx.districtm.io

URL

https://dmx.districtm.io/b/v1

Domain

dmx.districtm.io

URL

https://dmx.districtm.io/b/v1

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=109a3f73eb3aa67c;misc=1585239257623;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=110c264939ad8f2e;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=111fe4eb13fba59d;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1125aa59ccd1f408;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=113c02224c992b6b;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1140f31172b6dc4b;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11518d0d5af87038;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1167ecbecd2544b4;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11753e4886bff04;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11839b1ca293d702;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=119b29c2db192b5a;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=120784b0de6cd5f8;misc=1585239257624;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=12151f299364bb82;misc=1585239257624;

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=3ffea015-31da-4efa-a122-d53711d5807a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.35021108306359405

Domain

as-sec.casalemedia.com

URL

https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22130fdce3fe9e3692%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221318a6d943db48b7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221325248da4bd694d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22133a2d92af5f811%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&

Domain

tlx.3lift.com

URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tmax=1200

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=15445cb8e7835ccb;misc=1585239258900;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1555ef52885338c4;misc=1585239258900;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=15604b990a91223d;misc=1585239258900;

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1500fc7e669c1048&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=151343aa6281633a&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1920b58ceb0c2204&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1938faa9fe71a0b6&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ae98ee5b0-6f7c-11ea-a81f-121ea8d7377c;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=200a5c532d714134;misc=1585239286635

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ae991fc00-6f7c-11ea-a984-12724de64e5e;cfp=1;rndc=1585239286;v=2;cmd=bid;cors=yes;alias=199cbac9c24b860d;misc=1585239286635

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=2080f34d415fbc14&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=209c06916b0bfb67&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=231897c1c0e4bc99;misc=1585239287619;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=2322bb98ee6d8376;misc=1585239287619;

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=5f6aeff0-39de-459a-aaa3-fbb170ccc293&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.13918191259414314

Domain

freestar-d.openx.net

URL

https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=5f6aeff0-39de-459a-aaa3-fbb170ccc293&nocache=1585239287630&pubcid=1c76fe4a-5ef3-48d4-9a9a-f6a68d0a71fc&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_1&auid=540959250&

Domain

as-sec.casalemedia.com

URL

https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%222235f1bd2dc132bf%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22224b83f7eb7d5ac%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22225ed93c6156e338%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&

Domain

tlx.3lift.com

URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-mozart-malware-gets-commands-hides-traffic-using-dns%2F&tmax=1200