arstechnica.com Open in urlscan Pro
18.216.136.68 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-re...
Submission: On December 01 via api (December 1st 2021, 11:02:56 am UTC) from IL — Scanned from DE

Summary HTTP 75 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 29 IPs in 4 countries across 24 domains to perform 75 HTTP transactions. The main IP is 18.216.136.68, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is arstechnica.com.
TLS certificate: Issued by Amazon on November 29th 2021. Valid for: a year.

This is the only time arstechnica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	18.216.136.68 18.216.136.68	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
4	205.234.175.175 205.234.175.175	23352 (SERVERCEN...) (SERVERCENTRAL)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	2.18.234.190 2.18.234.190	16625 (AKAMAI-AS) (AKAMAI-AS)
3	13.35.253.9 13.35.253.9	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3	52.95.126.138 52.95.126.138	16509 (AMAZON-02) (AMAZON-02)
3	23.37.38.181 23.37.38.181	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.192.239 151.101.192.239	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
1	34.239.25.47 34.239.25.47	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400c:c08::9d	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
14	184.30.24.22 184.30.24.22	16625 (AKAMAI-AS) (AKAMAI-AS)
7	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
3	99.86.3.65 99.86.3.65	16509 (AMAZON-02) (AMAZON-02)
2	3.221.197.71 3.221.197.71	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2.16.186.67 2.16.186.67	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
75	29

1 18.216.136.68 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-136-68.us-east-2.compute.amazonaws.com

arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 205.234.175.175 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: vip1.G-anycast1.cachefly.net

cdn.arstechnica.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

d-7193374363477360033.ampproject.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

3p.ampproject.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.190 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-190.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.35.253.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-9.fra6.r.cloudfront.net

player.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.95.126.138 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.37.38.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-181.deploy.static.akamaitechnologies.com

amp.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.192.239 (United States)

ASN54113 (FASTLY, US)

api.condenast.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.239.25.47 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-239-25-47.compute-1.amazonaws.com

srv.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 184.30.24.22 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-22.deploy.static.akamaitechnologies.com

amprtc.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hbx.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hblg.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
warp.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.86.3.65 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-3-65.fra6.r.cloudfront.net

d2c8v52ll5s99u.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.221.197.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-197-71.compute-1.amazonaws.com

capture.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.67 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-67.deploy.static.akamaitechnologies.com

qsearch-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	media.net amprtc.media.net hbx.media.net hblg.media.net contextual.media.net warp.media.net lg3.media.net	158 KB
9	ampproject.org cdn.ampproject.org	213 KB
8	doubleclick.net 1 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net	37 KB
6	googlesyndication.com 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	28 KB
4	arstechnica.net cdn.arstechnica.net	159 KB
3	cloudfront.net d2c8v52ll5s99u.cloudfront.net	266 KB
3	casalemedia.com amp.casalemedia.com	2 KB
3	amazon-adsystem.com aax.amazon-adsystem.com	2 KB
3	google.com 1 redirects adservice.google.com ampcid.google.com www.google.com	2 KB
3	cnevids.com player.cnevids.com	38 KB
2	moatads.com z.moatads.com	219 KB
2	googletagservices.com www.googletagservices.com	73 KB
2	condenastdigital.com capture.condenastdigital.com	96 B
2	google.de ampcid.google.de www.google.de	961 B
2	ampproject.net d-7193374363477360033.ampproject.net 3p.ampproject.net	9 KB
2	gstatic.com fonts.gstatic.com	60 KB
2	googleapis.com fonts.googleapis.com imasdk.googleapis.com	125 KB
1	akamaihd.net qsearch-a.akamaihd.net	329 B
1	google-analytics.com 1 redirects www.google-analytics.com	453 B
1	parsely.com srv.pixel.parsely.com	260 B
1	googletagmanager.com www.googletagmanager.com	3 KB
1	condenast.io api.condenast.io	6 KB
1	outbrain.com widgets.outbrain.com	3 KB
1	arstechnica.com arstechnica.com	13 KB
75	24

	Domain	Requested by
9	cdn.ampproject.org	arstechnica.com cdn.ampproject.org
7	securepubads.g.doubleclick.net	cdn.ampproject.org 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com www.googletagservices.com
4	contextual.media.net	amprtc.media.net contextual.media.net arstechnica.com
4	amprtc.media.net	cdn.ampproject.org hbx.media.net
4	cdn.arstechnica.net	arstechnica.com
3	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com	cdn.ampproject.org
3	d2c8v52ll5s99u.cloudfront.net	player.cnevids.com d2c8v52ll5s99u.cloudfront.net
3	amp.casalemedia.com	cdn.ampproject.org
3	aax.amazon-adsystem.com	cdn.ampproject.org
3	player.cnevids.com	cdn.ampproject.org player.cnevids.com
2	tpc.googlesyndication.com	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
2	lg3.media.net	amprtc.media.net arstechnica.com
2	hblg.media.net	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com amprtc.media.net
2	z.moatads.com	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
2	www.googletagservices.com	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
2	capture.condenastdigital.com
2	fonts.gstatic.com	fonts.googleapis.com
1	pagead2.googlesyndication.com	www.googletagservices.com
1	warp.media.net	amprtc.media.net
1	qsearch-a.akamaihd.net	amprtc.media.net
1	hbx.media.net	46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
1	imasdk.googleapis.com	player.cnevids.com
1	www.google.de
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	www.google-analytics.com	1 redirects
1	ampcid.google.de	cdn.ampproject.org
1	ampcid.google.com	cdn.ampproject.org
1	srv.pixel.parsely.com
1	www.googletagmanager.com	cdn.ampproject.org
1	api.condenast.io	player.cnevids.com
1	adservice.google.com	cdn.ampproject.org
1	widgets.outbrain.com	cdn.ampproject.org
1	3p.ampproject.net	cdn.ampproject.org
1	d-7193374363477360033.ampproject.net	cdn.ampproject.org
1	fonts.googleapis.com	arstechnica.com
1	arstechnica.com
75	37

This site contains links to these domains. Also see Links.

Domain
go.redirectingat.com

Subject Issuer	Validity	Valid
*.arstechnica.com Amazon	`2021-11-29` - `2022-12-27`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cachefly.net GlobalSign RSA OV SSL CA 2018	`2021-10-18` - `2022-11-19`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2021-05-25` - `2022-06-01`	a year	crt.sh
*.cnevids.com Amazon	`2021-09-18` - `2022-10-17`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2021-04-09` - `2022-03-20`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.admagazine.fr GlobalSign Atlas R3 DV TLS CA 2020	`2021-07-22` - `2022-08-23`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.pixel.parsely.com R3	`2021-11-23` - `2022-02-21`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
conde.io Amazon	`2021-06-15` - `2022-07-14`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
a248.e.akamai.net DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1
Frame ID: 764ABE054BE983D78FA78BFDF7CF1302
Requests: 39 HTTP requests in this frame

Frame: https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology
Frame ID: CC7BBE92A03B5213F83A8FCC23C253BD
Requests: 11 HTTP requests in this frame

Frame: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0
Frame ID: 25C6D6307C3BFCB5D8E4DBCCB04AF648
Requests: 8 HTTP requests in this frame

Frame: https://amprtc.media.net/rtb/getadm?as=1&aid=65941d4f59a8418990577596f1a096eb_1&bid=4&cid=8CU17U83K&slot=268847668&act=headerBid&scpvid=&mnetfsc=eyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9
Frame ID: 72C4BD4A07D203EC835794AC8352124A
Requests: 7 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU3VL6IT&https=1&itype=CM
Frame ID: A53265E3D89A2A094BB2FB32BAAA026F
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=11&cv=31&https=1&cid=8CU17U83K&prvid=2033%2C2030%2C273%2C251%2C175%2C132%2C178%2C3018%2C3017%2C2027%2C3016%2C214%2C117%2C97%2C99%2C77%2C59%2C3012%2C262%2C222%2C201%2C4%2C246%2C147%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108&purpose1=1&gdprconsent=0&gdpr=1&usp_status=0&usp_consent=1&itype=AMPRTC
Frame ID: 9DFDF8C5DCB079ADB83B233A52B3525B
Requests: 1 HTTP requests in this frame

Frame: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0
Frame ID: F7E8E27D1D75D29472743FE6628060DB
Requests: 9 HTTP requests in this frame

Frame: data://truncated
Frame ID: 51611A4EFFAA6391712E710ED8F7240A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Eight months after discovery, unkillable LoJax rootkit campaign remains active – Ars Technica

Page Statistics

75
Requests

97 %
HTTPS

55 %
IPv6

24
Domains

37
Subdomains

29
IPs

4
Countries

1416 kB
Transfer

3867 kB
Size

6
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fcdn.arstechnica.net%2Fwp-content%2Fuploads%2F2018%2F10%2FGettyImages-981636794.jpg&sref=rss
Title: Enlarge

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fwww.gettyimages.com%2Fsearch%2Fphotographer%3Ffamily%3Deditorial%26amp%3Bphotographer%3Dpicture%2520alliance%26amp%3Bsort%3Dmostpopular%23license&sref=rss
Title: Lino Mirgeler/picture alliance via Getty Images

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fwww.facebook.com%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Farstechnica.com%252F%253Fpost_type%253Dpost%2526p%253D1441853&sref=rss
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Ftwitter.com%2Fshare%3Ftext%3DEight%2Bmonths%2Bafter%2Bdiscovery%252C%2Bunkillable%2BLoJax%2Brootkit%2Bcampaign%2Bremains%2Bactive%26amp%3Burl%3Dhttps%253A%252F%252Farstechnica.com%252F%253Fpost_type%253Dpost%2526p%253D1441853&sref=rss
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fwww.reddit.com%2Fsubmit%3Furl%3Dhttps%253A%252F%252Farstechnica.com%252F%253Fpost_type%253Dpost%2526p%253D1441853%26amp%3Btitle%3DEight%2Bmonths%2Bafter%2Bdiscovery%252C%2Bunkillable%2BLoJax%2Brootkit%2Bcampaign%2Bremains%2Bactive&sref=rss
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fasert.arbornetworks.com%2Flojack-becomes-a-double-agent%2F&sref=rss
Title: bombshell report

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fwww.welivesecurity.com%2Fwp-content%2Fuploads%2F2018%2F09%2FESET-LoJax.pdf&sref=rss
Title: researchers from Eset documented LoJax samples

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSerial_Peripheral_Interface_Bus&sref=rss
Title: Serial Peripheral Interface

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=http%3A%2F%2Fasert.arbornetworks.com%2Flojax-fancy-since-2016&sref=rss
Title: back with new research

Search URL Search Domain Scan URL

URL: http://go.redirectingat.com/?id=100098X1555750&xs=1&url=https%3A%2F%2Fwww.ncsc.gov.uk%2Fcontent%2Ffiles%2Fprotected_files%2Farticle_files%2FNCSC_APT28%2520v6.pdf&sref=rss
Title: research published in October

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

https://www.google-analytics.com/r/collect?v=1&_v=a1&gtm=2agba1GTM-P5RD9S8&ds=AMP&aip=true&_s=1&dt=Eight%20months%20after%20discovery%2C%20unkillable%20LoJax%20rootkit%20campaign%20remains%20active%20%E2%80%93%20Ars%20Technica&sr=1600x1200&_utmht=1638356570994&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&tid=UA-31997-1&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&dr=&sd=24&ul=en-us&de=UTF-8&jid=0.5434710533521856&t=pageview&_r=1&a=2056&z=0.3493992326682418&cm21=1&cm23=1&cd1=GTM-P5RD9S8&cd26=1441853&cd27=939&cd29=web&cd25=Dan%20Goodin&cd35=Fancy%20Bear%7Clojax%7Cmalware%7Crootkits%7Cuefi&cd28=Eight%20months%20after%20discovery%2C%20unkillable%20LoJax%20rootkit%20campaign%20remains%20active&cd34=2019-01-16T21%3A58%3A55%2B00%3A00&cd32=2019-01-16T14%3A00%3A15%2B00%3A00&cd93=information%20technology&cd94=&cd62=https%3A%2F%2Farstechnica.com%2F%3Fp%3D1441853&cd98=report&cd92=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&cd36=amp&cd13=AMP%20Pageview&cd111=&cd103=&cd21=&cd97=&cd39=&cd121=&cd114= HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418&slf_rd=1&random=2027065068

75 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/ 39 KB
13 KB 454ms
215ms Document
text/html 18.216.136.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.216.136.68 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-136-68.us-east-2.compute.amazonaws.com

Software

nginx/1.17.10 / PHP/7.3.31

Resource Hash

c53d187b79695b6addf3bebf13a465a2abc215e0543b0686098a53f27cd6c00d

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.17.10
x-powered-by: PHP/7.3.31
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
content-encoding: gzip

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 39ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Bitter|Economica:400,700|Open+Sans:400,700&display=swap

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aa98d3dcbd757b9f8803c7954e9cd2bf9834e55f58a2d0a8566d67690326424f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 11:02:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 11:02:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 100 KB
30 KB 128ms
32ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ca6bbd2e0a99f661cedde8e45fb0ed1feabc5d79baf2fe3622f4382c6af1c02

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30802
x-xss-protection: 0
server: sffe
date: Wed, 01 Dec 2021 11:02:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "fab0d37ab577631c"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H2 200 v0.js Show response
cdn.ampproject.org/ 267 KB
70 KB 111ms
17ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b78c0c195c9d6184c09a5f3dedd20ecb3eb50d9ba6a88fd1da2e2c9d51f4f18a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70175
x-xss-protection: 0
server: sffe
date: Wed, 01 Dec 2021 11:02:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=3000, stale-while-revalidate=1206600
etag: "31b0e038a7e22ad8"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H2 200 amp-ad-0.1.js Show response
cdn.ampproject.org/v0/ 72 KB
21 KB 118ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-ad-0.1.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e35a53ce01739d6a718c64636da6dea3dec9475672f79a39ab42cac8a867a8ac

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20969
x-xss-protection: 0
server: sffe
date: Wed, 01 Dec 2021 11:02:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "38cf1bbb05d4aee3"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H2 200 amp-iframe-0.1.js Show response
cdn.ampproject.org/v0/ 23 KB
8 KB 132ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-iframe-0.1.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c5933d65d7a2c290c6df9f8bb8c3fad07cc83cd63c9181221482d19335bac62

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8388
x-xss-protection: 0
server: sffe
date: Wed, 01 Dec 2021 11:02:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "31ae1afa5fcc8170"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H2 200 logo-ars-us.svg
cdn.arstechnica.net/wp-content/mu-plugins/ars-amp/assets//img/ 3 KB
3 KB 112ms
10ms Image
image/svg+xml 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/mu-plugins/ars-amp/assets//img/logo-ars-us.svg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: cfa3438ffc2f0f8f26accf059c1ec08cb20a956363ef15a1e8de37d481908477

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fA.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 2714
x-cf-tsc: 1638354498
x-cf2: H
last-modified: Wed, 27 Oct 2021 16:56:26 GMT
server: CFS 0215
x-cff: B
etag: "617984ba-a9a"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 13050
accept-ranges: bytes
expires: Wed, 26 Jan 2022 11:02:50 GMT

GET
H2 200 camera.png
cdn.arstechnica.net/wp-content/mu-plugins/ars-amp/assets/img/ 1 KB
1 KB 113ms
10ms Image
image/png 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/mu-plugins/ars-amp/assets/img/camera.png
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 884c5735bbe7c118613c754d253ba0d07ba2353783072f5d7b4a353509c47064

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fA.fra2:co:1582040241:cacheN.fra2-01:H
content-length: 1034
x-cf-tsc: 1638332617
x-cf2: H
last-modified: Wed, 27 Oct 2021 16:56:26 GMT
server: CFS 0215
x-cff: B
etag: "617984ba-40a"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 34774
accept-ranges: bytes
expires: Wed, 26 Jan 2022 11:02:50 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 42ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Bitter|Economica:400,700|Open+Sans:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:52:02 GMT
x-content-type-options: nosniff
age: 421848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:52:02 GMT

GET
H2 200 raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2
fonts.gstatic.com/s/bitter/v19/ 16 KB
16 KB 48ms
14ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/bitter/v19/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Bitter|Economica:400,700|Open+Sans:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2fbfbe4f76c7cba63ceab257e1efa4eb79fc0389b16c097dabd20c87425da91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 21:26:31 GMT
x-content-type-options: nosniff
age: 135379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 23:21:23 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 29 Nov 2022 21:26:31 GMT

GET
H2 200 Dang.jpg
cdn.arstechnica.net/wp-content/uploads/2018/10/ 90 KB
91 KB 9ms
8ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2018/10/Dang.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
x-cf3: H
x-amz-request-id: N0MR072WHV7HZ4XM
x-cf1: 14961:fA.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 92486
x-amz-id-2: TtKq0JxST14q+0HvHZ317Y1DodFF/WaStwBqYfOvk1oeNMo0q8l26TTlSZW4/ItOf9PWsXx/vEs=
x-cf-tsc: 1638197014
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 21 Dec 2019 01:48:48 GMT
server: CFS 0215
x-cff: B
etag: "03e5fec9e7ca5f8064d945bd791bd4c3"
x-amz-version-id: null
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 30471
accept-ranges: bytes
content-type: image/jpeg
x-cf-rand: 53.071
expires: Wed, 26 Jan 2022 11:02:50 GMT

GET
H2 200 GettyImages-981636794-800x533.jpg
cdn.arstechnica.net/wp-content/uploads/2018/10/ 63 KB
64 KB 32ms
32ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2018/10/GettyImages-981636794-800x533.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: ea9238b0e0b45fbcc34a2f202ebcd403d4b7b71ffeb75ca6157c3e8533e4c563

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fA.fra2:co:1525808045:cacheN.fra2-01:M
content-length: 64795
x-amz-request-id: V03QQ4ARGR691XMB
x-amz-id-2: 2FkEZ1xiiGJo1w1/iB3avOilBhemjO0WCwSDPocD+EIS0Ey4xzFK6tdotOvYCzKa3M4aJ9cOMro=
x-cf-tsc: 1638343707
x-cf2: H
last-modified: Sat, 21 Dec 2019 01:49:06 GMT
server: CFS 0215
x-cff: B
etag: "05bb35df94a96952c746c05128548f18"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
x-amz-version-id: null
accept-ranges: bytes
expires: Wed, 26 Jan 2022 11:02:50 GMT

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012111152338002/v0/ 7 KB
3 KB 29ms
11ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338002/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef520a6b136860d5d0e179188f34c6d7167eb7c570bf68126f739932f7431761

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 61163
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2909
x-xss-protection: 0
server: sffe
date: Tue, 30 Nov 2021 18:03:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a4a8d074de6a5095"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 30 Nov 2022 18:03:27 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012111152338002/v0/ 15 KB
4 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338002/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc2985c7ad914dcb5d60e1a998b74a52f480e2375598130a0c51de2a8aeed06f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 61163
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3727
x-xss-protection: 0
server: sffe
date: Tue, 30 Nov 2021 18:03:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ea1d618ef69f7354"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 30 Nov 2022 18:03:27 GMT

GET
H3 200 amp-ad-network-doubleclick-impl-0.1.js Show response
cdn.ampproject.org/rtv/012111152338002/v0/ 223 KB
59 KB 15ms
10ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338002/v0/amp-ad-network-doubleclick-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37bf82fb8c3270ebd4ddfe1ed79103fe2f2e9e0ff14233580ffd31fc49f2fac5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 61146
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60484
x-xss-protection: 0
server: sffe
date: Tue, 30 Nov 2021 18:03:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9ac0469580b06391"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 30 Nov 2022 18:03:44 GMT

GET
H2 200 frame.html
d-7193374363477360033.ampproject.net/2111152338002/ 0
0 259ms
14ms Other
text/html 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-7193374363477360033.ampproject.net/2111152338002/frame.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 outbrain.js
3p.ampproject.net/2111152338002/vendor/ 27 KB
9 KB 252ms
7ms Other
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3p.ampproject.net/2111152338002/vendor/outbrain.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9836787c1c3fa22d9815bb431d0bacaf794238c8c1b4d4add79785127ef9c5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 27 Nov 2021 09:36:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 350792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8915
x-xss-protection: 0
last-modified: Fri, 19 Nov 2021 02:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 27 Nov 2022 09:36:18 GMT

GET
H2 200 outbrainAMP.min.js
widgets.outbrain.com/widgetAMP/ 8 KB
3 KB 252ms
9ms Other
application/x-javascript 2.18.234.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetAMP/outbrainAMP.min.js
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.190 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8a494bcc2195a85c61e34de035741ee94b94e3dd639e9b20501bd9e4201feffa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 07:11:50 GMT
server: AkamaiNetStorage
etag: "482f7af0109c598c2bef971711e1f691:1615461380.580446"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=345600
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2482

GET
H/1.1 200
OK / Show response
player.cnevids.com/interlude/arstechnica/iframe/ Frame CC7B 50 KB
17 KB 153ms
116ms Document
text/html 13.35.253.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0/amp-iframe-0.1.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.35.253.9 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-253-9.fra6.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

bdc7b8f92a35e11c73d167441f5c69d8b33cbf0764fed00e0f95e430fa292172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/

Response headers

Content-Type: text/html; charset=utf-8
Content-Length: 17034
Connection: keep-alive
Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Date: Wed, 01 Dec 2021 11:02:50 GMT
ETag: W/"3f29dfd4e0e2b1db8aa99a0ae06c1b09"
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
Status: 200 OK
X-Backend-Node: 10.110.75.179
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: b16ee07d-7ce5-46db-867d-b169a1f1d18a
X-Runtime: 0.006647
X-XSS-Protection: 1; mode=block
Vary: Origin,Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 2f0580a0593ad9d3fb82aee9226d8179.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
X-Amz-Cf-Id: aQ4NnDLnmwMQvvBkwrSx1n-1MZugx7F9xoP7a1_IR8GAgGREz97qTQ==

GET
H2 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
574 B 78ms
41ms Fetch
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=arstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 11:02:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
access-control-allow-origin: https://arstechnica.com
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H/1.1 200
OK bid Show response
aax.amazon-adsystem.com/e/dtb/ 16 B
662 B 129ms
43ms Fetch
application/json 52.95.126.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3035&pubid=PUB_UUID&amp=1&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&slots=%5B%7B%22sd%22%3A%22%2F3379%2Fconde.ars%2Fhero%2Finformation-technology%2Famp%2F1%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22ms%22%3A%22300x50%22%7D%5D&pj=%7B%22amp%22%3A%221%22%7D&gdprc=&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.126.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:50 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
AMP-Access-Control-Allow-Source-Origin: https://arstechnica.com
Server: Server
x-amz-rid: 1CT7N636YXWJPXVRNYF8
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Access-Control-Allow-Credentials: true
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16

GET
H/1.1 200
OK amprtc Show response
amp.casalemedia.com/ 2 B
463 B 146ms
99ms Fetch
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amp.casalemedia.com/amprtc?v=1&w=320&h=50&ow=&oh=&ms=300x50&s=385077&p=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&consent_state=&consent_string=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 11:02:50 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[91.199.118.79], XFF:[]
Server: Apache
Content-Type: application/json
Access-Control-Allow-Origin: https://arstechnica.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2
X-AK-CLIENT-GEO: 12
Expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H/1.1 200
OK bid Show response
aax.amazon-adsystem.com/e/dtb/ 16 B
662 B 125ms
38ms Fetch
application/json 52.95.126.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3035&pubid=PUB_UUID&amp=1&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&slots=%5B%7B%22sd%22%3A%22%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22ms%22%3A%22%22%7D%5D&pj=%7B%22amp%22%3A%221%22%7D&gdprc=&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.126.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:50 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
AMP-Access-Control-Allow-Source-Origin: https://arstechnica.com
Server: Server
x-amz-rid: 2K5QNGSFTX25K4S4JG3P
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Access-Control-Allow-Credentials: true
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16

GET
H/1.1 200
OK amprtc Show response
amp.casalemedia.com/ 182 B
645 B 180ms
133ms Fetch
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amp.casalemedia.com/amprtc?v=1&w=300&h=250&ow=&oh=&ms=&s=383253&p=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&consent_state=&consent_string=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 771f3a46a8a71a9642a6193df4d0de8e92e71cd90fc18f97ff3d0f23a1ceee71

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 11:02:50 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[91.199.118.79], XFF:[]
Server: Apache
Content-Type: application/json
Access-Control-Allow-Origin: https://arstechnica.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 182
X-AK-CLIENT-GEO: 12
Expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H/1.1 200
OK bid Show response
aax.amazon-adsystem.com/e/dtb/ 16 B
662 B 130ms
42ms Fetch
application/json 52.95.126.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3035&pubid=PUB_UUID&amp=1&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&slots=%5B%7B%22sd%22%3A%22%2F3379%2Fconde.ars%2Ffooter%2Finformation-technology%2Famp%2F1%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22ms%22%3A%22300x50%22%7D%5D&pj=%7B%22amp%22%3A%221%22%7D&gdprc=&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.126.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:50 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
AMP-Access-Control-Allow-Source-Origin: https://arstechnica.com
Server: Server
x-amz-rid: 6P104BA9EJTGM12K1MCP
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Access-Control-Allow-Credentials: true
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16

GET
H/1.1 200
OK amprtc Show response
amp.casalemedia.com/ 2 B
463 B 138ms
92ms Fetch
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amp.casalemedia.com/amprtc?v=1&w=320&h=50&ow=&oh=&ms=300x50&s=383255&p=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&consent_state=&consent_string=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 11:02:50 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[91.199.118.79], XFF:[]
Server: Apache
Content-Type: application/json
Access-Control-Allow-Origin: https://arstechnica.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2
X-AK-CLIENT-GEO: 12
Expires: Wed, 01 Dec 2021 11:02:50 GMT

GET
H3 200 amp-lightbox-gallery-0.1.js Show response
cdn.ampproject.org/rtv/012111152338002/v0/ 59 KB
18 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338002/v0/amp-lightbox-gallery-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09a7023ce9b3cc853618363af7edd99a300cb8d46c20ff602f497174ce3d830e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/
Origin: https://arstechnica.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 61162
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18172
x-xss-protection: 0
server: sffe
date: Tue, 30 Nov 2021 18:03:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "90f87499325aea4d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 30 Nov 2022 18:03:28 GMT

GET
H/1.1 200
OK recommendations Show response
api.condenast.io/v1/ Frame CC7B 16 KB
6 KB 200ms
159ms Fetch
application/json 151.101.192.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.condenast.io/v1/recommendations?applicationID=cne-interlude-arstechnica&brand=arstechnica&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&filter%5Bstrategy%5D=POPULAR&filter%5BcontentType%5D=CNEVIDEO&filter%5Blanguage%5D=en-US&page%5Bsize%5D=5
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.192.239 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.15.8 /
Resource Hash: df2e5e1df408826a2be37032abc13f89e71fae6cf50b6dfaabafb0dbaecea292

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
X-Backend: 2SrKDXXFWNz87LdtRpzPzK--F_api_eu_central_1_condenast_io
access-control-allow-origin: https://player.cnevids.com
transfer-encoding: chunked
X-Cache: MISS
Connection: keep-alive
X-Served-By: cache-hhn4031-HHN
Server: nginx/1.15.8
X-Timer: S1638356571.961849,VS0,VE153
Vary: origin,accept-encoding, Accept-Encoding, Origin
Content-Type: application/json;charset=utf-8
Via: 1.1 varnish
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: private, max-age=0
access-control-allow-credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H2 200 amp.json Show response
www.googletagmanager.com/ 29 KB
3 KB 47ms
17ms Fetch
application/json 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/amp.json?id=GTM-P5RD9S8&gtm.url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e6aac112b79ca1a73caa53c90ddfe2ccd4b5d10cadbd4e5e0a363aeef2fc5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:50 GMT
content-encoding: br
vary: *
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="GTM-P5RD9S8.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2323
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://arstechnica.com
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 parsely.json Show response
cdn.ampproject.org/rtv/012111152338002/v0/analytics-vendors/ 835 B
424 B 12ms
11ms Fetch
application/json 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338002/v0/analytics-vendors/parsely.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fae28fcab23026155838be7a52d391f3ed4e25769a154c2d15265b7adf26bfb0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 61050
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 394
x-xss-protection: 0
server: sffe
date: Tue, 30 Nov 2021 18:05:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "651d8e63717bedd6"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 30 Nov 2022 18:05:20 GMT

GET
H/1.1 200
OK /
srv.pixel.parsely.com/plogger/ 43 B
260 B 413ms
101ms Image
image/gif 34.239.25.47
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv.pixel.parsely.com/plogger/?rand=1638356570951&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&urlref=&screen=1600x1200%7C1600x1200%7C24&title=Eight%20months%20after%20discovery%2C%20unkillable%20LoJax%20rootkit%20campaign%20remains%20active%20%E2%80%93%20Ars%20Technica&date=1638356570952&ampid=amp-pPnuUMvO3mYVpMAl0nVRzw&action=pageview&metadata={%22canonical_url%22:%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%22}
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.25.47 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-25-47.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:51 GMT
Cache-Control: no-cache
Last-Modified: Wednesday, 01-Dec-2021 11:02:51 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
531 B 50ms
14ms Fetch
application/json 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 94
x-xss-protection: 0

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
460 B 37ms
15ms Fetch
application/json 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=a1&gtm=2agba1GTM-P5RD9S8&ds=AMP&aip=true&_s=1&dt=Eight%20months%20after%20discovery%2C%20unkillable%20LoJax%20rootkit%20campaign%20remains%20active...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418&slf_rd=1&random=2027065068

42 B
501 B

51ms
30ms

Image
image/gif

2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418&slf_rd=1&random=2027065068

Protocol

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=amp-mtfGlyz3iUjyDM4eWPTlYw&jid=0.5434710533521856&_v=a1&z=0.3493992326682418&slf_rd=1&random=2027065068
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getrtc Show response
amprtc.media.net/rtb/ 42 B
317 B 186ms
163ms Fetch 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getrtc?cid=8CU17U83K&w=320&h=50&ow=&oh=&ms=300x50&slot=%2F3379%2Fconde.ars%2Fhero%2Finformation-technology%2Famp%2F1&tgt=%7B%22pos_instance%22%3A%221%22%2C%22pos%22%3A%22hero%22%2C%22partner%22%3A%5B%22amp%22%5D%2C%22ctx_template%22%3A%22amp-article%22%2C%22ctx_page_slug%22%3A%228-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%22%2C%22cnt_tags%22%3A%5B%22Fancy%20Bear%22%2C%22lojax%22%2C%22malware%22%2C%22rootkits%22%2C%22uefi%22%5D%7D&curl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&to=1000&purl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&cste=&cstr=&adcid=amp-mtfGlyz3iUjyDM4eWPTlYw&dmsv=&ep=77&st=0&ph=4974&bks=visible&ref=&dj=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
amp-access-control-allow-source-origin: https://arstechnica.com
server: nginx
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Amp-Access-Control-Allow-Source-Origin
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 getrtc Show response
amprtc.media.net/rtb/ 919 B
976 B 163ms
140ms Fetch 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getrtc?cid=8CU17U83K&w=300&h=250&ow=&oh=&ms=&slot=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&tgt=%7B%22pos_instance%22%3A%221%22%2C%22pos%22%3A%22mid-content%22%2C%22partner%22%3A%5B%22amp%22%5D%2C%22ctx_template%22%3A%22amp-article%22%2C%22ctx_page_slug%22%3A%228-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%22%2C%22cnt_tags%22%3A%5B%22Fancy%20Bear%22%2C%22lojax%22%2C%22malware%22%2C%22rootkits%22%2C%22uefi%22%5D%7D&curl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&to=1000&purl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&cste=&cstr=&adcid=amp-mtfGlyz3iUjyDM4eWPTlYw&dmsv=&ep=2496&st=0&ph=4974&bks=visible&ref=&dj=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a4158617609257ab8ff996af91dc16257accfaa3575c7483824726d2a4e0440d

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: https://arstechnica.com
server: nginx
vary: Accept-Encoding
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Amp-Access-Control-Allow-Source-Origin
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 680
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 getrtc Show response
amprtc.media.net/rtb/ 42 B
317 B 151ms
128ms Fetch 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getrtc?cid=8CU17U83K&w=320&h=50&ow=&oh=&ms=300x50&slot=%2F3379%2Fconde.ars%2Ffooter%2Finformation-technology%2Famp%2F1&tgt=%7B%22pos_instance%22%3A%221%22%2C%22pos%22%3A%22footer%22%2C%22partner%22%3A%5B%22amp%22%5D%2C%22ctx_template%22%3A%22amp-article%22%2C%22ctx_page_slug%22%3A%228-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%22%2C%22cnt_tags%22%3A%5B%22Fancy%20Bear%22%2C%22lojax%22%2C%22malware%22%2C%22rootkits%22%2C%22uefi%22%5D%7D&curl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&to=1000&purl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&cste=&cstr=&adcid=amp-mtfGlyz3iUjyDM4eWPTlYw&dmsv=&ep=4135&st=0&ph=4974&bks=visible&ref=&dj=&__amp_source_origin=https%3A%2F%2Farstechnica.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106

Request headers

Accept: application/json
Referer: https://arstechnica.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
amp-access-control-allow-source-origin: https://arstechnica.com
server: nginx
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Amp-Access-Control-Allow-Source-Origin
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H/1.1 200
OK 5fac054038d0695db9ad7760.js Show response
player.cnevids.com/inline/video/ Frame CC7B 57 KB
20 KB 110ms
109ms Script
text/javascript 13.35.253.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/inline/video/5fac054038d0695db9ad7760.js?analyticsUrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude&pageType=amp-article&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_42a13cbe-a0a4-4f1c-8076-861b918187a2_video-popularity-1_fallback_cral-top2-2&recStrategy=cral_top2_2&showPlaylistBar=false&target=embedplayer

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.35.253.9 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-253-9.fra6.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

187248b892582984032e2d99101fe3621f4330cedddef3c8d4ccb32634d7c78c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA6-C1
X-Cache: Miss from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 19507
X-XSS-Protection: 1; mode=block
X-Request-Id: e3054e8e-aa4e-4bd2-92ca-60a002a5fe55
X-Runtime: 0.006282
X-Backend-Node: 10.110.45.86
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
ETag: W/"efd7bd35ba2b113409231ffcea022683"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 2f0580a0593ad9d3fb82aee9226d8179.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Id: nTvvcYu0AO2AuQOyzWAbbyj2oFapTWVpO9AkVvYXM1mX_veMaDougw==

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 661ms
625ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F3379%2Fconde.ars%2Ffooter%2Finformation-technology%2Famp%2F1&adk=483193751&sz=320x50%7C300x50&output=html&impl=ifr&ifi=1&msz=650x-1&psz=650x-1&fws=4&scp=pos_instance%3D1%26pos%3Dfooter%26partner%3Damp%26ctx_template%3Damp-article%26ctx_page_slug%3D8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%26cnt_tags%3DFancy%2520Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%26mnetDNB%3D1%26mnetCT%3D0&adf=659165507&nhd=0&adx=640&ady=4135&oid=2&ptt=13&gdfp_req=1&sfv=1-0-37&u_sd=1&artc=152%2C463%2C152&ati=2%2C2%2C2&ard=aps%2Cmedianet%2Cindexexchange&is_amp=3&amp_v=2111152338002&d_imp=1&c=34002056&ga_cid=amp-mtfGlyz3iUjyDM4eWPTlYw&ga_hid=2056&dt=1638356570750&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&bc=7&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&bdt=505&dtd=472&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

f83d24e8c3b8a36dfa3fd598f1320056a5e73bd136c161fcd419c8512034663f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: br
x-content-type-options: nosniff
x-ampsafeframeversion: 1-0-38
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
x-ampadrender: safeframe
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12713
x-xss-protection: 0
google-lineitem-id: 5344163681
x-qqid: CIusyeu5wvQCFRHJdwodh8cF0Q
amp-access-control-allow-source-origin: https://arstechnica.com
server: cafe
google-mediationtag-id: -2
google-creative-id: 138291807535
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Google-Creative-Id,Google-LineItem-Id,AMP-Access-Control-Allow-Source-Origin,X-QQID,amp-ff-sandbox,X-AmpSafeFrameVersion,X-AmpAdRender
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
amp-ff-sandbox: true
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
11 KB 391ms
365ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&adk=3643915799&sz=300x250&output=html&impl=ifr&ifi=2&msz=300x-1&psz=300x-1&fws=4&scp=pos_instance%3D1%26pos%3Dmid-content%26partner%3Damp%26ctx_template%3Damp-article%26ctx_page_slug%3D8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%26cnt_tags%3DFancy%2520Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%26mnetSize%3D300x250%26mnetAct%3DheaderBid%26mnetUGD%3D4%26mnetfsc%3DeyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9%26mnet_placement%3D268847668%26mnetbidID%3D4%26mnetbidPrice%3D0.17%26mnetPageID%3D65941d4f59a8418990577596f1a096eb_1%26mnetCT%3D2%26mnetCC%3DDE%26mnetCID%3D8CU17U83K%26300x250_unk2%3DYXU9NCZwY2lkPURGNUJDNUEzNTUwMCZzPTVEOTE1JnQ9NjFBNzU2NUEmY3A9MC4wMyZyPURGNUJDNUEz%26AOM%3D300x250_1%26asPath%3Dhttps%253A%252F%252Fa2171.casalemedia.com%252Fpcreative&adf=1217486012&nhd=0&adx=650&ady=2496&oid=2&ptt=13&gdfp_req=1&sfv=1-0-37&u_sd=1&artc=152%2C475%2C185&ati=2%2C2%2C2&ard=aps%2Cmedianet%2Cindexexchange&is_amp=3&amp_v=2111152338002&d_imp=1&c=34002056&ga_cid=amp-mtfGlyz3iUjyDM4eWPTlYw&ga_hid=2056&dt=1638356570750&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&bc=7&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&bdt=505&dtd=482&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

ef7de717e56d8310ab8a5b5759026cce0ac15e478bdde1ab447ed5100ad00b8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: br
x-content-type-options: nosniff
x-ampsafeframeversion: 1-0-38
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
x-ampadrender: safeframe
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10206
x-xss-protection: 0
google-lineitem-id: 5449375325
x-qqid: CJiZyeu5wvQCFdSGgwcddZACCw
amp-access-control-allow-source-origin: https://arstechnica.com
server: cafe
google-mediationtag-id: -2
google-creative-id: 138319923119
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Google-Creative-Id,Google-LineItem-Id,AMP-Access-Control-Allow-Source-Origin,X-QQID,amp-ff-sandbox,X-AmpSafeFrameVersion,X-AmpAdRender
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
amp-ff-sandbox: true
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H/1.1 400
Bad Request embed-api.json Show response
player.cnevids.com/ Frame CC7B 50 B
812 B 114ms
114ms Fetch
application/json 13.35.253.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/embed-api.json?videoId=5fac054038d0695db9ad7760&playerType=interlude&embedLocation=arstechnica

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/inline/video/5fac054038d0695db9ad7760.js?analyticsUrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude&pageType=amp-article&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_42a13cbe-a0a4-4f1c-8076-861b918187a2_video-popularity-1_fallback_cral-top2-2&recStrategy=cral_top2_2&showPlaylistBar=false&target=embedplayer

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.35.253.9 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-253-9.fra6.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

82f3834d998aae8cd5b9c9e5b1334404bac616f33a47072dbf034b6e177a4baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/interlude/arstechnica/iframe/?pageURL=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&pageType=amp-article&tags=Fancy+Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%2Cinformation-technology
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 11:02:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA6-C1
X-Cache: Error from cloudfront
Status: 400 Bad Request
Connection: keep-alive
Content-Length: 75
X-XSS-Protection: 1; mode=block
X-Request-Id: 72277159-0b1b-4a24-bab7-71fdd2dee1f7
X-Runtime: 0.006685
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: application/json; charset=utf-8
Via: 1.1 2f0580a0593ad9d3fb82aee9226d8179.cloudfront.net (CloudFront)
Cache-Control: no-cache
X-Amz-Cf-Id: IKBVMHjuaNZ51IxWUVYPmht1XItigaNczk_ADJAol53afOQK_R0wow==

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame CC7B 374 KB
124 KB 45ms
22ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15a3efce4e527795167d6fb4bb107345067176ddfc514a85cf0ee9a031b07e55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126291
x-xss-protection: 0
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H/1.1 200
OK player-style-839c3e98ef8199d5df9c.css
d2c8v52ll5s99u.cloudfront.net/player/ Frame CC7B 88 KB
13 KB 34ms
7ms Stylesheet
text/css 99.86.3.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-839c3e98ef8199d5df9c.css
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/inline/video/5fac054038d0695db9ad7760.js?analyticsUrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude&pageType=amp-article&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_42a13cbe-a0a4-4f1c-8076-861b918187a2_video-popularity-1_fallback_cral-top2-2&recStrategy=cral_top2_2&showPlaylistBar=false&target=embedplayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.3.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-65.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 474e43543efcb5a0bf6c248cbfff92130a2a5611cd0d57ec64170ba982abd99e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 22 Nov 2021 21:39:51 GMT
Content-Encoding: gzip
Age: 739381
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 12683
Last-Modified: Thu, 18 Nov 2021 10:11:57 GMT
Server: AmazonS3
ETag: "c3e312ffe7ea1e1fe08e47e617b867c2"
x-amz-version-id: jUUszsuWmYA3NL0GlcDSU1h1wjHyhdY0
Via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Type: text/css; charset=utf-8
X-Amz-Cf-Id: V2_UQIIGTIeWdEBsrBayVwtbZVH9FLGvbUD1txkIzFZ0NxTi894VEw==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H/1.1 200
OK main-33b69421b409255f51e9.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame CC7B 817 KB
223 KB 35ms
8ms Script
application/javascript 99.86.3.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-33b69421b409255f51e9.js
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/inline/video/5fac054038d0695db9ad7760.js?analyticsUrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude&pageType=amp-article&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_42a13cbe-a0a4-4f1c-8076-861b918187a2_video-popularity-1_fallback_cral-top2-2&recStrategy=cral_top2_2&showPlaylistBar=false&target=embedplayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.3.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-65.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9497adc9501cea74c45d33bba48eefed24ad69256d02db42c09b8a8131c78488

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 16:24:32 GMT
Content-Encoding: gzip
Age: 671900
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 227773
Last-Modified: Tue, 23 Nov 2021 16:21:48 GMT
Server: AmazonS3
ETag: "76880434a0b72af8c017e6f987d40165"
x-amz-version-id: GfSEYKeeSrJrqOY4PvTueOSLiPkDa33c
Via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Type: application/javascript
X-Amz-Cf-Id: uhH5ERxlCsaib-o2zBq4pRdB9cw814HsTIrRFZm5QmBL9977bis1iQ==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 891ms
888ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F3379%2Fconde.ars%2Fhero%2Finformation-technology%2Famp%2F1&adk=97862549&sz=320x50%7C300x50&output=html&impl=ifr&ifi=3&msz=710x-1&psz=710x-1&fws=4&scp=pos_instance%3D1%26pos%3Dhero%26partner%3Damp%26ctx_template%3Damp-article%26ctx_page_slug%3D8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%26cnt_tags%3DFancy%2520Bear%2Clojax%2Cmalware%2Crootkits%2Cuefi%26mnetDNB%3D1%26mnetCT%3D0&adf=2427338964&nhd=0&adx=650&ady=77&oid=2&ptt=13&gdfp_req=1&sfv=1-0-37&u_sd=1&artc=155%2C503%2C167&ati=2%2C2%2C2&ard=aps%2Cmedianet%2Cindexexchange&is_amp=3&amp_v=2111152338002&d_imp=1&c=34002056&ga_cid=amp-mtfGlyz3iUjyDM4eWPTlYw&ga_hid=2056&dt=1638356570750&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&bc=7&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F%3Famp%3D1&bdt=505&dtd=506&__amp_source_origin=https%3A%2F%2Farstechnica.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

054dfef98688c9f23e5139a43b323c4d706dc5a6fea7f03a1c3797c369fe83b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:52 GMT
content-encoding: br
x-content-type-options: nosniff
x-ampsafeframeversion: 1-0-38
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
x-ampadrender: safeframe
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12734
x-xss-protection: 0
google-lineitem-id: 5344163681
x-qqid: CJStyeu5wvQCFVyDgwcdHFkHrA
amp-access-control-allow-source-origin: https://arstechnica.com
server: cafe
google-mediationtag-id: -2
google-creative-id: 138291807541
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: Google-Creative-Id,Google-LineItem-Id,AMP-Access-Control-Allow-Source-Origin,X-QQID,amp-ff-sandbox,X-AmpSafeFrameVersion,X-AmpAdRender
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
amp-ff-sandbox: true
expires: Wed, 01 Dec 2021 11:02:52 GMT

GET
H/1.1 200
OK sf-ui-display-medium-webfont.woff2
d2c8v52ll5s99u.cloudfront.net/assets/fonts/ Frame CC7B 29 KB
30 KB 406ms
385ms Font
application/font-woff2 99.86.3.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/assets/fonts/sf-ui-display-medium-webfont.woff2
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-839c3e98ef8199d5df9c.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.3.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-65.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3

Request headers

Referer: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-839c3e98ef8199d5df9c.css
Origin: https://player.cnevids.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: null
Content-Encoding: gzip
ETag: "7d18db04f980971f2a9c5026bbc34bed"
X-Amz-Cf-Pop: FRA6-C1
X-Cache: RefreshHit from cloudfront
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 29632
Access-Control-Allow-Origin: *
Last-Modified: Mon, 26 Jun 2017 15:24:42 GMT
Server: AmazonS3
Date: Wed, 01 Dec 2021 11:02:52 GMT
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods: GET
Content-Type: application/font-woff2
Via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: v2dOQHlThnsDKaXziqJhmLZCuoQBN-ebfLThFExytcB_kpm5q5wuzw==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
BLOB 200
OK 21b41842-96d7-4b01-8ddb-edd2ce6da943
https://player.cnevids.com/ Frame CC7B 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://player.cnevids.com/21b41842-96d7-4b01-8ddb-edd2ce6da943
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame CC7B 48 B
48 B 414ms
103ms Image
image/gif 3.221.197.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Fplayer.cnevids.com%2Finterlude%2Farstechnica%2Fiframe%2F%3FpageURL%3Dhttps%253A%252F%252Farstechnica.com%252Finformation-technology%252F2019%252F01%252F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%252F%26pageType%3Damp-article%26tags%3DFancy%2BBear%252Clojax%252Cmalware%252Crootkits%252Cuefi%252Cinformation-technology%23amp%3D1&pID=&sID=&uId=&xid=&_ts=2021-12-01T11%3A02%3A51.396Z&_c=error&_t=FetchConfigError&cId=5fac054038d0695db9ad7760&dim1=%7B%22guid%22%3A%22c2702a92-7f6d-ba1a-456a-6edbd38061e3%22%2C%22iu%22%3Anull%2C%22playerType%22%3A%22interlude%22%7D&dim3=API%20ERROR%3A%20400%20(Bad%20Request)
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.221.197.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-221-197-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 01 Dec 2021 11:02:51 GMT
Connection: keep-alive
transfer-encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame CC7B 48 B
48 B 414ms
103ms Image
image/gif 3.221.197.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Fplayer.cnevids.com%2Finterlude%2Farstechnica%2Fiframe%2F%3FpageURL%3Dhttps%253A%252F%252Farstechnica.com%252Finformation-technology%252F2019%252F01%252F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%252F%26pageType%3Damp-article%26tags%3DFancy%2BBear%252Clojax%252Cmalware%252Crootkits%252Cuefi%252Cinformation-technology%23amp%3D1&pID=&sID=&uId=&xid=&_ts=2021-12-01T11%3A02%3A51.396Z&_c=error&_t=FetchConfigError&cId=5fac054038d0695db9ad7760&dim1=%7B%22guid%22%3A%22c2702a92-7f6d-ba1a-456a-6edbd38061e3%22%2C%22iu%22%3Anull%2C%22playerType%22%3A%22interlude%22%7D&dim3=Interlude%20Embed%20Failed.
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.221.197.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-221-197-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://player.cnevids.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 01 Dec 2021 11:02:51 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 container.html
46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 65ms
14ms Other
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 container.html Show response
46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 25C6 6 KB
3 KB 60ms
15ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0/amp-ad-0.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 01 Dec 2021 11:02:51 GMT
expires: Thu, 01 Dec 2022 11:02:51 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ucreative.js Show response
hbx.media.net/__media__/js/ Frame 25C6 4 KB
1 KB 22ms
13ms Script
application/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hbx.media.net/__media__/js/ucreative.js?cv=

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8f27ce418a6d82a9ace65c2bdfdc4f9827692fdecd2edb872dd3d9caa86999be

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Wed, 01 Dec 2021 11:02:51 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=189840
content-length: 1127
expires: Fri, 03 Dec 2021 15:46:51 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 25C6 119 KB
37 KB 48ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame 25C6 327 KB
110 KB 64ms
6ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7112424642afa738dc9cc44bb73fb9712622cf5738ba53e87e15e3acc901407b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:51 GMT
content-encoding: gzip
last-modified: Tue, 02 Nov 2021 14:27:30 GMT
server: AmazonS3
x-amz-request-id: EGDT4QCSZA453HEV
etag: "73ed686ae085e8af6fb101aaac697d48"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=34897
accept-ranges: bytes
content-length: 111837
x-amz-id-2: L3z206Fs7DlTIt2B3vNVDeDyaCGVMGvBvkj+Z/a8z6BEfGsMzG9zsTK6P6DNtHhjyMSCn4u95hE=

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 25C6 0
26 B 56ms
41ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsty5jVMWawormRV0lTllgi3w_40l_7DxH3mfUao1J1h5MJMuWmhCvWhh9mmNGgOu73hwUO-DlHpLbu4VrewAweu6Mtdtyht62Rm8SYZz3WE6t4aE8LCL0MBtKyUObZBLWi8_r_nKY50Hr4LZx3D68oaJ8VytzyLWuH9iFKZRyjJxcJI2-LQ78X5ZCVNZ7RyFDlTMmOfl1CmgWmqNALzNmagE64Cn8V29VslRFp4Hdbma2XNS1FWbMUx8uY336vfXQ10dyUUwTeWeXaTT184LNb4ZgVgl6jOT1fDlWnXrlre-jZPmOUkE7pDSX3Vrb5JhjkR3_j82422n1S7anuPWvL5w4nVd99LvMNGNY-kWQ&sig=Cg0ArKJSzGok0Q6JsCXdEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 11:02:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 log
hblg.media.net/ Frame 25C6 35 B
194 B 17ms
9ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&ct=2&cid=8CU17U83K&crid=268847668&pvid=4&act=headerBid&aid=65941d4f59a8418990577596f1a096eb_1&size=300x250&sc_pvid=&cc=DE&ugd=4&td=&dn=https%3A%2F%2F46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com&requrl=https%3A%2F%2F46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html%3Fn%3D0&r=1638356571710
Requested by: Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 getadm Show response
amprtc.media.net/rtb/ Frame 72C4 9 KB
4 KB 69ms
69ms Document
text/html 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getadm?as=1&aid=65941d4f59a8418990577596f1a096eb_1&bid=4&cid=8CU17U83K&slot=268847668&act=headerBid&scpvid=&mnetfsc=eyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9
Requested by: Host: hbx.media.net
URL: https://hbx.media.net/__media__/js/ucreative.js?cv=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: b31cf05a6d95d086e051b42fe87b3b821238801f8da53ce7f1cce1c13d9190a0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/

Response headers

server: nginx
vary: Accept-Encoding
content-encoding: gzip
expires: Wed, 01 Dec 2021 11:02:51 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Wed, 01 Dec 2021 11:02:51 GMT
content-length: 3536

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame 72C4 128 KB
43 KB 70ms
63ms Script
text/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU3VL6IT

Requested by

Host: amprtc.media.net
URL: https://amprtc.media.net/rtb/getadm?as=1&aid=65941d4f59a8418990577596f1a096eb_1&bid=4&cid=8CU17U83K&slot=268847668&act=headerBid&scpvid=&mnetfsc=eyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

a96de9a8698477851424072ce80c61e0500839abcc0893c088505c464fcb4c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-mnt-h: 10-3
content-encoding: gzip
server: Apache
etag: "dc5d7517d8922834f7d510f7ec150ae6"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Wed, 01 Dec 2021 11:02:51 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-9
expires: Wed, 01 Dec 2021 11:07:51 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 72C4 35 B
329 B 60ms
8ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=prod&bdr_typ=1&ss_d1=0&ogerpm=0.1800&ss_d2=0&stid=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&other_prv=4&jar_err=&current_day=3.0&req_id=&bd_m3=0.0000&bidfp=0.0000&bd_m2=0.0000&bd_m1=0.0000&ugd=4&dim10=false&exp=&second_bidder=*&floor_bucket=0.00&seat=BID_API&size=300x250&url_l1=information-technology&f_seg=&url_l2=2019&prdp=0.1700&ogcbdp=0.1700&dfpbd=0.1700&server=1&ogerpm_wd_bkt=0-1&viewability=-0.0100&dmm_r=0.0000&cut=0&dmm_l=0.0000&tcyerpm=&sc=HE&send_erpm=false&sd=-1&seg=&erpm_bucket=0.20&ugd_ver=&requrl=arstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&bidrestime=1638356571211&cc=DE&strg=no_strategy&ss=&current_hour=10&time_stamp=2021-12-01+11%3A02%3A51&rvshhon=&bdp=0.1700&ct=&akey=&mnckfl=0&bdp_bucket=0.15&algo=mrg-0.5&dc=eu_be&splid=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&dn=arstechnica.com&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36&bdp_wider_bucket=1&acid=65941d4f59a8418990577596f1a096eb_1&infl=&o_ver=NT+10.0&br_ver=96.0.4664.45&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m5=0.0000&ver=8.3&totalTimeBucket=2&visibility=-1&totalTime=2313940&dmm_m1=2021-12-01+11%3A02%3A51.213916789&e_rpm=0.0000&dmm_m22=0.1800&gdpr=&vsid=EEA0000&log_less=false&ogerpm_used=false&bdmm_m12=0.0000&cid=8CU17U83K&rawbid=0.1700&seat_id=BID_API&sub_bidder=196&pbshr=100.0000&dmm_d10=&o_id=101&clisp=rtb-common-74f946b695-ccxkq.BE&dfp_bucket=0.18&adblk=&itype=amprtc&pvid_seat=4_BID_API&cliIP=1539798528&advurl=&crid=268847668&sat=0&br_id=265&cut_bkt=5&iwb=1&second_bid=0.000000&sc_pvid=4&capd=0&other_bids=0.17
Requested by: Host: amprtc.media.net
URL: https://amprtc.media.net/rtb/getadm?as=1&aid=65941d4f59a8418990577596f1a096eb_1&bid=4&cid=8CU17U83K&slot=268847668&act=headerBid&scpvid=&mnetfsc=eyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.67 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-67.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 11:02:51 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame 72C4 61 KB
62 KB 31ms
24ms Script
application/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Wed, 01 Dec 2021 11:02:51 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=35874
access-control-allow-credentials: true
content-length: 62892
expires: Wed, 01 Dec 2021 21:00:45 GMT

GET
DATA 200
OK truncated
/ Frame 25C6 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 27e7295d1c49dd5c891274241bbfcd329001ed3579aa8d21364307872107cad8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 smtr Show response
contextual.media.net/ Frame 72C4 86 KB
32 KB 1475ms
1475ms Script
text/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU3VL6IT&cpcd=eSrs49rXwLhR46I3s3iqcA%3D%3D&crid=814304626&size=300x250&cc=DE&chnm=NO_STRATEGY&https=1&vif=2&requrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&kwrf=https%3A%2F%2Farstechnica.com&nse=5&vi=1638356571652366838&lw=1&ugd=4&chnm2=8CU17U83K&chnm3=268847668&adt1=8CU17U83K&adt2=268847668&bcpf=8fOnRrolnfOur8B4%2Fq%2FzxBxB&bdrId=4&matchstring=hr%3D0&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU3VL6IT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Resource Hash

4c26b8112db80ecdf0208278d72339b344f2215769ea75ee688a358d81348652

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:53 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=604800
content-length: 32627
expires: Wed, 01 Dec 2021 11:02:53 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame A532 15 KB
6 KB 42ms
42ms Document
text/html 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU3VL6IT&https=1&itype=CM

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ef80bdf8a5fbe6f4188e41bbf081aa1c092de67e4e0848b729a73112eeb11897

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Fri, 03 Dec 2021 11:02:51 GMT
date: Wed, 01 Dec 2021 11:02:51 GMT
content-length: 5715

GET
H2 200 bping.php
lg3.media.net/ Frame 72C4 35 B
189 B 39ms
24ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRVCXX19&cid=8CU3VL6IT&crid=814304626&vi=1638356571652366838&ugd=4&lf=6&kwrf=https%3A%2F%2Farstechnica.com&cc=DE&sc=HE&lper=100&wsip=2886781035&r=1638356571938&requrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=62240&vgd_rakh=1638356571199318554&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_pgid=p11900732334t202112011102&vgd_pgids=1&vgd_uspa=0&hvsid=00001638356571936015397985281430&gdpr=1&vgd_end=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Wed, 01 Dec 2021 11:02:51 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 01 Dec 2021 11:02:51 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9DFD 22 KB
8 KB 44ms
43ms Document
text/html 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=11&cv=31&https=1&cid=8CU17U83K&prvid=2033%2C2030%2C273%2C251%2C175%2C132%2C178%2C3018%2C3017%2C2027%2C3016%2C214%2C117%2C97%2C99%2C77%2C59%2C3012%2C262%2C222%2C201%2C4%2C246%2C147%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108&purpose1=1&gdprconsent=0&gdpr=1&usp_status=0&usp_consent=1&itype=AMPRTC

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1eea2dddefbf5b8cdcc65c09c770a70d293e5486b33be9c6c30d1b250fe18aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Fri, 03 Dec 2021 11:02:51 GMT
date: Wed, 01 Dec 2021 11:02:51 GMT
content-length: 8157

GET
H2 200 clog
hblg.media.net/ Frame 72C4 35 B
172 B 27ms
27ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&prvAccId=814304626&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.17&mx_nsz=1&csex=0&spSource=0&vid=65941d4f59a8418990577596f1a096eb&pvdTmax=169&s_city=frankfurt+am+main&ltime=37.0&ugd=4&epc=814304626&prvReqId=23309898398117_1842419772_268847668141&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D0%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1&app=0&ctr=-1.0&exid=31&spFst=0&mx_TAF=0&mx_GCID=0&cliIPType=v4&pexid=AMPRTC-8CU17U83K&ae=false&ybnca_erpm=0.18&brsrclk=0&mx_UCC=1&sbdrid=196&prspt=headerBid&rtttime=73&usp_status=0&seat=BID_API&apTags%3C%3E=75&mx_PC=1&og_cbdp=0.170&size=300x250&wsip=mowx-f87d78965-5sbfv&currsrc_date=2021-11-29+00%3A00%3A00&mx_gpid_sent=false&xtmax=250&commit_id=cc0dd5ab&mx_SPRIG=0&viewability=-1&mx_divid=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&be=0&rtime=30.0&adj0=0.0&s_ip=91.199.118.79&adj2=0.0&adj1=0.0&geoll=false&mx_lr_seg_cnt=0&adtypes=0&mx_aabpc=0&debug_ts=2021-12-01+11%3A02%3A51&sc=HE&sd=-1&mx_ssProfile=0&mx_SC=0&reftime=15000&pbidflr=0.000&spbf=0&mowxReqId=65941d4f59a8418990577596f1a096eb_1_3&currsrc=API&fpusp=false&requrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&mnrfc=0&bidrestime=1638356571211&pv_adtype=0&cc=DE&strg=NO_STRATEGY&amptype=2&pcrid=8CU3VL6IT-814304626-49-28&moau=false&coppa_enf=false&ocurr=USD&is_rewarded=false&bdp=0.170&stagid=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&spIsReq=3&s=1&snm=SUCCESS&abs=0%7C0%7Cbflag%3D0%7CNO_STRATEGY%7Cbrr%3D0&mx_IAB2=0&mx_epbc=8CU3VL6IT&mx_ssBucket=0&vls=0&asn=62240&usp_enf=1&bidflr=0.000&mang=1&mx_isLossNtf=false&dn=arstechnica.com&pid=8PRL4E7N3&spTo=3&dt=O&acid=65941d4f59a8418990577596f1a096eb_1&kwrf=https%3A%2F%2Farstechnica.com%2F&actltime=38&act=headerBid&pvid=4&iframingState=0&is_ortb=false&mx_aurl_hc=0&bdata=sd2%3Dnull%7Eiurl_l%3D20%7Eogerpm%3D0.18%7Evis_sd%3D26%7Edc2%3D1%7Escd%3Dhe%7Evl2r_sd%3D2021120105%7Eiurl_b%3D1798.76%7Eurl_tkc%3D0%7Estd%3D%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1%7EMP%3D.*tech.*%7Elast%3D%7Evis_url_b%3D0.55%7Eip%3D1GcPW8%7Efbb%3D0%7Evis_url_l%3D10%7Eriipua%3D0%2C0%7Eet%3D28%7Erc%3D1%7Erps_sd%3D2021120106%7Evis_b%3D670.11%7Eurl_b%3D0.56%7Eurl_tvi%3D0%7Esmm_wr%3D2.1250%7Eurl_l%3D20%7Egcat%3D501188%7Ebb%3D196%7Evv%3D0%7El2r_b%3D1000%7Eerpm%3D0.18%7EMFB%3D2jo%7Ebm%3D1%7Esmm_sd%3D2021113021%7Esid%3D8bc797d6694c50897edb031e8dadd5c1%7Esd%3D-1%7Euid%3D22d5FLanWDpxFPvdmL%7Ebtd%3D17692471710890890630955510379200870542208777161305004742113495178678274%7E3pcf%3D1000%7Euim%3D0%7Evurl_b%3D1.28%7Ess%3DNA%7Euiw%3D-1%7Ece%3D0%7Erps_b%3D85.01%7Evurl_l%3D10%7ECI%3D2624%7Ents%3D1%7EMP2%3D.*tech.*%7Etb%3D-1%7Ect%3Dfrankfurt+am+main%7Ebasis2%3D196%7Ebasis1%3D196%7EisRef%3D0%7Eivurl_b%3D0.78%7EPF%3D0%7Eisif%3D0%7Elc%3D0%7Ebid%3D0.17%7Edc%3D8%7Evl2r_b%3D3.16%7Eivurl_l%3D10%7Esupply_tag_id%3D%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1%7Eamp%3D2%7Ecbdp%3D0.170%7Edmm%3Dno_strategy%7Esd%3D-1%7Edtc%3Deu_be%7Eref_cnt%3D0%7Edalg%3Dmrg-0.5%7Ebflag%3D0%7Esobp%3D%7Ebdpcapd%3D0%7Edmm_erpm%3Dfalse%7Ebflr%3D0.000%7Eogbid%3D0.170%7Eseller_tag_id%3D%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1%7Edcut%3D5%7Edogb%3D0-1%7Eibc%3D1%7Eddt%3D-1%7Ensz%3D1%7Etgs%3D300x250%7Ebsb%3D0%7Ebsp%3D0%7Etmx%3D169&mx_lr_seg_deal=0&dfpBd=0.17&sckfl=0&dmm_erpm=false&mx_lr=0&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=-1&dbf=1&bfs=103&rfc=0&gdpr=1&prvApiId=8CU3VL6IT&dmm_ogerpm=false&epcexp=false&pubid=pub-8CU17U83K&csip=rtb-common-74f946b695-ccxkq.BE&mx_bsProfile=0&mx_bsBucket=0&cid=8CU17U83K&bcrid=8C14U3VL6IT-814304626-49-28&mx_aurt=0&omul=1.0&spIvt=3&dsid=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&apPrfs%3C%3E=53%23%2313%23%2316%23%2343&ptype=26&vertical=0&chnl=NO_STRATEGY&smsrc=1&acsn=1&reqsize=300x250&dtc=eu_be&fpvid=amp-mtfGlyz3iUjyDM4eWPTlYw&adpos=0&mx_aqcpl_crid=0&ogbdp=0.17&tpbTkn=false&fpuReq=1&itype=AMPRTC&vcmplrt=-1.0&mx_g_one_uid_sent=None&crid=268847668&geo_source=0&sat=0&mnet_ckfl=0&spCst=0&tgtval=pub-8CU17U83K&dfpDiv=%2F3379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Famp%2F1&__expireat=1638357171465&opbidflr=0.000&reftype=0&rme=adm&utime=741&sf=0&cpr=0.7067956378263756
Requested by: Host: amprtc.media.net
URL: https://amprtc.media.net/rtb/getadm?as=1&aid=65941d4f59a8418990577596f1a096eb_1&bid=4&cid=8CU17U83K&slot=268847668&act=headerBid&scpvid=&mnetfsc=eyJjdXJsIjoiaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE5LzAxLzgtbW9udGhzLWFmdGVyLWl0cy1kaXNjb3ZlcnktdW5raWxsYWJsZS1sb2pheC1yb290a2l0LWNhbXBhaWduLXJlbWFpbnMtYWN0aXZlLyIsInB1cmwiOiJodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMTkvMDEvOC1tb250aHMtYWZ0ZXItaXRzLWRpc2NvdmVyeS11bmtpbGxhYmxlLWxvamF4LXJvb3RraXQtY2FtcGFpZ24tcmVtYWlucy1hY3RpdmUvP2FtcD0xIiwib2diZHAiOnsiNCI6MC4xN30sImJ0cyI6e30sInNpemUiOnsiNCI6IjMwMHgyNTAifSwiaXNHZHByIjp0cnVlLCJhZHNsb3QiOiIyNjg4NDc2NjgiLCJwIjoiOFBSTDRFN04zIiwiYyI6IjhDVTE3VTgzSyIsImdkcHJDb25zZW50IjoiIiwicmVmQ291bnQiOjAsImFkY2lkIjoiYW1wLW10ZkdseXozaVVqeURNNGVXUFRsWXciLCJleHBpcnkiOjE2MzgzNTcxNzAyMTZ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-22.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: max-age=3600
date: Wed, 01 Dec 2021 11:02:51 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Wed, 01 Dec 2021 17:02:51 GMT

GET
H3 200 container.html Show response
46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F7E8 6 KB
3 KB 23ms
8ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0/amp-ad-0.1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://arstechnica.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 01 Dec 2021 11:02:51 GMT
expires: Thu, 01 Dec 2022 11:02:51 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame F7E8 2 KB
2 KB 46ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 10:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 568
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 10:53:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F7E8 119 KB
36 KB 30ms
16ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 11:02:52 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame F7E8 327 KB
110 KB 11ms
10ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7112424642afa738dc9cc44bb73fb9712622cf5738ba53e87e15e3acc901407b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 11:02:52 GMT
content-encoding: gzip
last-modified: Tue, 02 Nov 2021 14:27:30 GMT
server: AmazonS3
x-amz-request-id: EGDT4QCSZA453HEV
etag: "73ed686ae085e8af6fb101aaac697d48"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=34896
accept-ranges: bytes
content-length: 111837
x-amz-id-2: L3z206Fs7DlTIt2B3vNVDeDyaCGVMGvBvkj+Z/a8z6BEfGsMzG9zsTK6P6DNtHhjyMSCn4u95hE=

GET
H2 200 13212144588834568078
tpc.googlesyndication.com/simgad/ Frame F7E8 19 KB
20 KB 47ms
8ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13212144588834568078

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9bca8ac977a63fbb19b21f023b3d12430ebe78c443fa9fd10f3c362b3a8bf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 05:53:08 GMT
x-content-type-options: nosniff
age: 18584
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19887
x-xss-protection: 0
last-modified: Mon, 21 Oct 2019 17:35:20 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 01 Dec 2022 05:53:08 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F7E8 0
23 B 41ms
41ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssAPkTM7l5oVyQaIR_kUJ-E7agRhg_9BnokBV1iqhJwoOo08hYXlnGxupYrZWxJ2xy2zqRrQ_lXfUBeAq9MFMEil9BfFboY9qCUTCQjbRNXX6tL01mlw_p6dlZAONPJ-KbfludBuQ6euElvgqjKj_SjReOZBouelZha7czkJzgKBgfKOD4NHoF_gwPHJdluBTsI0VDOK3VB9ZeM_Fm2KzLn6DUU969526mdlPuyCSlILGnQH06aXs1Z_T9ca87Yda64j_sI3X6GaDm6qwYcnvmjIQvqD4hUf1mPqBHwhxGk8RcG2LnsFubEbQFyB8LHBsTnLlTuasj9DnnF3uwGQfRV2Bl3&sig=Cg0ArKJSzI0e0nNW23tLEAE&uach_m=[UACH]&adurl=

Requested by

Host: 46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
URL: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 11:02:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame F7E8 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf1c445316a3a3636aff78044507a405138724ef067937c1db47b022d1086d90

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F7E8 0
0 56ms
42ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssCSdDFNsI7ah6R5s22qSIA43JYnyub99UCMiwU7SfLFuLHiNGSx18NASZJfEBbdsHhD2Yizybqs7iZkeRepe9jRKBhyVWrV9o1a-Mw0A5UaSZ-Ef0k5xY_vyWcSu1grforPnXkfJoIQrokLp8VQzpFeY5OSSEUQTmHx_3DsEzf1XrOOjRuYSjPxeGWXpwgkefNNixReFfJKa0pN5YEy6vDx7QrAV5NBfXw9lfFN4L8CAxZK7klxxF3JC2kQjrnOukAUdJi9KfPAbLBjlcEhhoY9rm3s9W2KZcYHXJaUvAFWppExdBxrg3k7k7FvGZoXRUhq-3E9jfMeC5wWqZ2ntq4lfUQh5c&sig=Cg0ArKJSzGUbfK5e03IDEAE&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 11:02:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 01 Dec 2021 11:02:52 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F7E8 42 B
497 B 63ms
41ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstZmY5Znjqm0AtCSbeTA388nPoNScOkFkYNTlaaxRGZvfY-fLgAXiavLJRwWP7bGz7p5uO4iT4SPeLWqMS9ryuoNGaF9UDdcF0P6cZoyGS6WAUp9sgU&sig=Cg0ArKJSzND7VY7JJkUvEAE&id=lidar2&mcvt=1000&p=0,0,50,320&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=0.88&if=1&app=0&itpl=3&adk=97862549&rs=1&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638356572152&rpt=134&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 11:02:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 5161 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5161 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5161 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 5161 15 B
216 B 10ms
10ms Script
text/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&&vgd_l2type=sca&v=1&gdpr=1&geo=50.11%7C8.68&dlper=20&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=&cc=DE&wsip=170785125&bca=0&ugd=4&vgd_chost=&vgd_fcic=0&vgde_setid=Nff&ksu=243&fdkt=244&kwd[]=Mehr+Zinsen+auf+dem+Festgeldkonto&kwt[]=244&kbc[]=1204762510&kwp[]=1&kid[]=330038576&kbc2[]=rps%3D1.25%7C%7Cps%3D0.545%7C%7Crpc%3D1.03%7C%7Clvl%3D4.00&ktd[]=274894881024&ktrkt[]=Mehr+Zinsen+auf+dem+Festgeldkonto&kwd[]=Diese+Banken+bieten+die+h%C3%B6chsten+Tagesgeldzinsen&kwt[]=244&kbc[]=1204762510&kwp[]=2&kid[]=329752371&kbc2[]=rps%3D0.77%7C%7Cps%3D0.545%7C%7Crpc%3D1.30%7C%7Clvl%3D4.00&ktd[]=274894881024&ktrkt[]=Diese+Banken+bieten+die+h%C3%B6chsten+Tagesgeldzinsen&kwd[]=Die+besten+Kreditkarten+im+Vergleich&kwt[]=244&kbc[]=1204762510&kwp[]=3&kid[]=329677325&kbc2[]=rps%3D1.29%7C%7Cps%3D0.545%7C%7Crpc%3D0.43%7C%7Clvl%3D2.41&ktd[]=274894881024&ktrkt[]=Die+besten+Kreditkarten+im+Vergleich&kwd[]=Tagesgeldkonten+mit+hohen+Zinsen&kwt[]=244&kbc[]=1204762510&kwp[]=4&kid[]=329625578&kbc2[]=rps%3D0.33%7C%7Cps%3D0.545%7C%7Crpc%3D2.15%7C%7Clvl%3D4.00&ktd[]=274894881024&ktrkt[]=Tagesgeldkonten+mit+hohen+Zinsen&kwd[]=Mini+Neuwagen-Modelle+2021&kwt[]=244&kbc[]=1204762510&kwp[]=5&kid[]=330227488&kbc2[]=rps%3D0.70%7C%7Cps%3D0.545%7C%7Crpc%3D0.36%7C%7Clvl%3D2.93&ktd[]=274894881024&ktrkt[]=Mini+Neuwagen-Modelle+2021&cid=8CU3VL6IT&vwid=1638356571652366838&vi=1638356571652366838&tdAdd[]=ib%3D0&vsid=2813581729860756000V10&kbbq=asn%3D62240%26&tdAdd[]=asnum%3D62240&vgd_l3_sc=he&vgd_hb_audit_1=8CU17U83K&vgd_hb_audit_2=268847668&vgd_refdomain=arstechnica.com&vgd_katid=808059642&vgd_katbid=-21&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785125&vgd_nrrv=52461&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=frankfurt+am+main&vgd_kalog=HID%3D6%7C%7CSID%3D13%7C%7CMI%3D2554%7C%7CTPTD%3D549764404740%7C%7CMPTD%3D720%7C%7CSI%3D2554%7C%7CCI%3D2555%7C%7CUUID%3DrSfTgSmkTsU6C3I7b&&tdAdd[]=%7C%40%7Cabp%3A1%3A2&vgd_ifrmode=11&vgd_l1rakh=1638356571199318554&sttm=1638356571936&upk=1638356572.8646&hvsid=00001638356571936015397985281430&verid=3111299&vgd_matchstr=hr%3D0&sbdrId=196&vgd_isiolc=1&vgd_fcm_enc_mis=1&pc=48&katen=1&pid=8POM3Q779&&abpl=2&&vgd_vstrid=EEA0000&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.uW~e8QMQOvfF~ONfvu~QNOvwJ~ejfLMQOvf9fuuf9u9X~8xLjMGvuhiW.hF~xLjM7UNv9~Q7OvSAAhiSNmzOJ.1LQSY8OoNmz7Jz7S8zkmLY178mzo7JNwzmjmy5S1YESu~c0v.*7JNw.*~j1Q7v~e8QMxLjMGv9.XX~8EvuZN0pW~kGGv9~e8QMxLjMjvu9~L88Ex1v9%2C9~J7vfW~LNvu~LEQMQOvf9fuuf9u9F~e8QMGvFh9.uu~xLjMGv9.XF~xLjM7e8v9~QYYMBLvf.ufX9~xLjMjvf9~yN17vX9uuWW~GGvuiF~eev9~jfLMGvu999~JLEYv9.uW~csRvfdm~GYvu~QYYMQOvf9fuuuA9fu~Q8OvWGNhihOFFiHNX9WihJOG9AuJWO1OOXNu~QOvou~x8OvffOXsT1zprE-s0eOYT~G7OvuhFifHhuhu9Wi9Wi9FA9iXXXu9Ahif99Wh9XHff9WhhhuFuA9X99HhHfuuAHiXuhWFhWfhH~AENkvu999~x8Yv9~exLjMGvu.fW~QQvIK~x8Bvou~NJv9~LEQMGvWX.9u~exLjMjvu9~%3DVvfFfH~z7Qvu~c0fv.*7JNw.*~7Gvou~N7vkL1zUkxL7%2B1Y%2BY18z~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGv9.hW~0sv9~8Q8kv9~jNv9~G8Ov9.uh~ONvW~ejfLMGvA.uF~8exLjMjvu9~QxEEj5M71yM8OvSAAhiSNmzOJ.1LQSY8OoNmz7Jz7S8zkmLY178mzo7JNwzmjmy5S1YESu~1YEvf~NGOEv9.uh9~OYYvzmMQ7L17Jy5~QOvou~O7NvJxMGJ~LJkMNz7v9~O1jyvYLyo9.X~Gkj1yv9~QmGEv~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.uh9~QJjjJLM71yM8OvSAAhiSNmzOJ.1LQSY8OoNmz7Jz7S8zkmLY178mzo7JNwzmjmy5S1YESu~ONx7vX~OmyGv9ou~8GNvu~OO7vou~zQlvu~7yQvA99-fX9~GQGv9~GQEv9~7Y-vuFi&vgd_optout=0&vgd_cfud=210611&vgd_scsver=107&vgd_l2ch=0&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=eu_be&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250&&vgd_uspa=0&vgd_sc=HE&vgd_l1rhst=contextual.media.net&hvsid=00001638356571936015397985281430&subBdr=196&bdrid=4&fp=jqRhx-dRQMvJR1EsG7klUzivi3QnOTWbsFF3zv3UDuG_tHx27gpO8TTNTJs145_9krx0BO5dkKaEMu3T2ed2yoE9TRaAM9wzfO0L71kmO0eHfuMyLcRHix9hfuBl0j_s&cme=bXf7yfQqolhmPve2jHfYGp0SbLaSWzRKE7aiKVxZo_Ba59CP4uU7dBht8PzkG6SO2UDMTVSdRTCYAG9C01S-7F50bEngdWqQEBofUGJgUfRApePaJA9ZguFRKKIOgCbXdWYnzVnfdSAZAIKssai_s-bi0j7yrNJuBjfzsaXYhV9ZIxpq5hvdBhkd6L_MIg5c_O9lrfdY1ZX6n3-6O7vsvhD8lwEn3krt0P5KipNSuQ_ZR7GkAsPmlwSEJmQkcRri2NULhssjfhsRU2HKD22CRIE5CgK-NizqypGGhq4Ik7nyJ3yV2XibiGIoidrQvGAkeIU0D94nF7U%3D%7C%7Cu8A6SM53vAcvz7yCsSx-n6xilYaV5FYK%7Csj1-8fOEyOCcYyjx9FAvxCCsJeAEyD3U%7CPRfD8C5X6m3oGoy0wMFDxCoSGj_fylcT%7Cxrl5Md8q4-8Qt9_leyE2-g-rx-QHr8FTj5jZKCp2F_I%3D%7CVtoYYjl8LebSdCvLfkDa1OnspZh7o2lO6UUE-31XnDGUbYVQGR3gBHe-mB819I9HBB8ng2BjYFR8dfxEx5IJezbf7NKfTQ7NZ2Yza5UssmSvsRAa880Jw-cdkYq2687Z0W_Yc7TIGArHjlzpPme-XV-McTY9qy2z%7CgNTUc7MBYV04UVzmztpDDQ%3D%3D%7CSBPPEaAepi42JIT7YQ6EL9b_b4dNavc1OO7zXrNYMRK6l_-UOBNJJAeDcC7TCrlVnGsI5So-fZlx2UrFQzRdENdRSI9sCJ2wBLstFXxkQlcevA16vHlgqjzbp9XYt6JGLsbugYYrvBz5lo8Aq4GMkBwY883cZ-mIJjogwiVUEw7T4z4opYFmpOw-vZo46-ECtILL9zDQedVK84cR-QgwhNrvDc-HXIjqt-v7sdB1hnI%3D%7Ch7g7ZAHNCfb2XK9RgzmVmcrjJYgGhfsv%7CECZQquDAdXO219s_zvdUcg%3D%3D%7CPUTkuMt0rl3WSehacIu7BC3Q2Ib_ofgx%7C&rc=0&rand=1638356573439&acid=65941d4f59a8418990577596f1a096eb_1&matm=1638356573439&requrl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F01%2F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%2F&vgd_ltime=1531&vgd_ltimesrc=2&vgd_l1hcsd=N3%7C7996&vgd_l1ch=1&vgd_lhl=3136&vgd_pgid=p11900732334t202112011102&vgd_kals=ttype%3D10019%7C%7Cpc%3D48%7C%7Cfat%3D0&vgd_csip=rtb-common-74f946b695-ccxkq.BE&vgd_sbSup=1&vgd_nrrs=52461&vgd_cntrdt=SF%7Camprtc.media.net&vgd_crefurl=https%3A%2F%2Farstechnica.com%2F&oRurl=adt1%3D8CU17U83K%26adt2%3D268847668%26bdrId%3D4%26cb%3Dwindow._mNDetails.initAd%26cc%3DDE%26chnm%3DNO_STRATEGY%26chnm2%3D8CU17U83K%26chnm3%3D268847668%26cid%3D8CU3VL6IT%26cpcd%3DeSrs49rXwLhR46I3s3iqcA%253D%253D%26crid%3D814304626%26gdpr%3D1%26https%3D1%26kwrf%3Dhttps%253A%252F%252Farstechnica.com%26lw%3D1%26matchstring%3Dhr%253D0%26nb%3D1%26nse%3D5%26requrl%3Dhttps%253A%252F%252Farstechnica.com%252Finformation-technology%252F2019%252F01%252F8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active%252F%26size%3D300x250%26ugd%3D4%26vif%3D2&vgd_end=1

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://amprtc.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Wed, 01 Dec 2021 11:02:53 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Wed, 01 Dec 2021 11:02:53 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 25C6 0
0 42ms
42ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsve1bYYaDoqahR_DwKSG8Qre1Pt1iNVEvyqLAlWFI-HsyFFlJ-16l28LjmTcUto7r-ZXlBamMQNJcy08ADXaQ_DjoJTP99De7sxKVASg8v7RvZla2IcsOu-bmT_sqn5OLaZAHKPE0bbG925K9IP_MIkPT5bW1vibPm4PeRL0BGOora6W0EWbChGAU0jRehxw-NgyGrDEUyVTFvna73CxtlhI7HUP4m93tPjpZJvW_y75ZADxm0k39Mz9fbR4HnkhtTQTc3X89QqZv3sFUVkEUg0wQCvERW7G59na1GXqC412vYw0FrZZr5scLlCdI8LrvtWCFHxbi-OPZrWsaCb4S7rV8vSVF3LR5dTubQM8hds&sig=Cg0ArKJSzJjBL3cYj4CKEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 11:02:53 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 01 Dec 2021 11:02:53 GMT

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.arstechnica.com/	1970-01-20 07:51:32	Name: _parsely_visitor Value: amp-pPnuUMvO3mYVpMAl0nVRzw
.arstechnica.com/	1970-01-19 23:06:00	Name: AMP_TOKEN Value: %24NOT_FOUND
.arstechnica.com/	1970-01-20 07:51:32	Name: _ga Value: amp-mtfGlyz3iUjyDM4eWPTlYw
.doubleclick.net/	1970-01-20 08:27:32	Name: IDE Value: AHWqTUnOyAXShv_lVN5wL1u1_G8TddGRqFc5hP5fh020bJWGhUkLJ0ISdKCA4sVk1As
.doubleclick.net/	1970-01-19 23:05:57	Name: test_cookie Value: CheckForPermission
.media.net/	1970-01-20 07:51:32	Name: visitor-id Value: 2813581729860756000V10

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://player.cnevids.com/embed-api.json?videoId=5fac054038d0695db9ad7760&playerType=interlude&embedLocation=arstechnica Message: Failed to load resource: the server responded with a status of 400 (Bad Request)
javascript	warning	URL: https://z.moatads.com/condenastdfp9588492144/moatad.js(Line 134) Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
javascript	warning	URL: https://z.moatads.com/condenastdfp9588492144/moatad.js(Line 134) Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
javascript	warning	URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1 Message: The resource https://3p.ampproject.net/2111152338002/vendor/outbrain.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1 Message: The resource https://46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1 Message: The resource https://d-7193374363477360033.ampproject.net/2111152338002/frame.html was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://arstechnica.com/information-technology/2019/01/8-months-after-its-discovery-unkillable-lojax-rootkit-campaign-remains-active/?amp=1 Message: The resource https://widgets.outbrain.com/widgetAMP/outbrainAMP.min.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3p.ampproject.net
46dce77360efbeac96d3b44db844b586.safeframe.googlesyndication.com
aax.amazon-adsystem.com
adservice.google.com
amp.casalemedia.com
ampcid.google.com
ampcid.google.de
amprtc.media.net
api.condenast.io
arstechnica.com
capture.condenastdigital.com
cdn.ampproject.org
cdn.arstechnica.net
contextual.media.net
d-7193374363477360033.ampproject.net
d2c8v52ll5s99u.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
hblg.media.net
hbx.media.net
imasdk.googleapis.com
lg3.media.net
pagead2.googlesyndication.com
player.cnevids.com
qsearch-a.akamaihd.net
securepubads.g.doubleclick.net
srv.pixel.parsely.com
stats.g.doubleclick.net
tpc.googlesyndication.com
warp.media.net
widgets.outbrain.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
z.moatads.com
13.35.253.9
142.250.186.130
151.101.192.239
18.216.136.68
184.30.24.22
2.16.186.67
2.18.234.190
2.18.235.40
205.234.175.175
23.37.38.181
2a00:1450:4001:801::2002
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2003
2a00:1450:4001:810::200a
2a00:1450:4001:812::2002
2a00:1450:4001:827::200e
2a00:1450:4001:828::200e
2a00:1450:4001:829::2003
2a00:1450:4001:829::2008
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2004
2a00:1450:4001:831::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c08::9d
3.221.197.71
34.239.25.47
52.95.126.138
99.86.3.65
054dfef98688c9f23e5139a43b323c4d706dc5a6fea7f03a1c3797c369fe83b7
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
09a7023ce9b3cc853618363af7edd99a300cb8d46c20ff602f497174ce3d830e
14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154
15a3efce4e527795167d6fb4bb107345067176ddfc514a85cf0ee9a031b07e55
187248b892582984032e2d99101fe3621f4330cedddef3c8d4ccb32634d7c78c
1eea2dddefbf5b8cdcc65c09c770a70d293e5486b33be9c6c30d1b250fe18aed
27e7295d1c49dd5c891274241bbfcd329001ed3579aa8d21364307872107cad8
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
37bf82fb8c3270ebd4ddfe1ed79103fe2f2e9e0ff14233580ffd31fc49f2fac5
3e6aac112b79ca1a73caa53c90ddfe2ccd4b5d10cadbd4e5e0a363aeef2fc5d2
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
474e43543efcb5a0bf6c248cbfff92130a2a5611cd0d57ec64170ba982abd99e
4c26b8112db80ecdf0208278d72339b344f2215769ea75ee688a358d81348652
5ca6bbd2e0a99f661cedde8e45fb0ed1feabc5d79baf2fe3622f4382c6af1c02
7112424642afa738dc9cc44bb73fb9712622cf5738ba53e87e15e3acc901407b
771f3a46a8a71a9642a6193df4d0de8e92e71cd90fc18f97ff3d0f23a1ceee71
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
82f3834d998aae8cd5b9c9e5b1334404bac616f33a47072dbf034b6e177a4baf
884c5735bbe7c118613c754d253ba0d07ba2353783072f5d7b4a353509c47064
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
8a494bcc2195a85c61e34de035741ee94b94e3dd639e9b20501bd9e4201feffa
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8c5933d65d7a2c290c6df9f8bb8c3fad07cc83cd63c9181221482d19335bac62
8f27ce418a6d82a9ace65c2bdfdc4f9827692fdecd2edb872dd3d9caa86999be
9497adc9501cea74c45d33bba48eefed24ad69256d02db42c09b8a8131c78488
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
a4158617609257ab8ff996af91dc16257accfaa3575c7483824726d2a4e0440d
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a96de9a8698477851424072ce80c61e0500839abcc0893c088505c464fcb4c63
aa98d3dcbd757b9f8803c7954e9cd2bf9834e55f58a2d0a8566d67690326424f
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b31cf05a6d95d086e051b42fe87b3b821238801f8da53ce7f1cce1c13d9190a0
b78c0c195c9d6184c09a5f3dedd20ecb3eb50d9ba6a88fd1da2e2c9d51f4f18a
b9836787c1c3fa22d9815bb431d0bacaf794238c8c1b4d4add79785127ef9c5b
bdc7b8f92a35e11c73d167441f5c69d8b33cbf0764fed00e0f95e430fa292172
c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106
c53d187b79695b6addf3bebf13a465a2abc215e0543b0686098a53f27cd6c00d
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cc2985c7ad914dcb5d60e1a998b74a52f480e2375598130a0c51de2a8aeed06f
cf1c445316a3a3636aff78044507a405138724ef067937c1db47b022d1086d90
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfa3438ffc2f0f8f26accf059c1ec08cb20a956363ef15a1e8de37d481908477
d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3
d2fbfbe4f76c7cba63ceab257e1efa4eb79fc0389b16c097dabd20c87425da91
d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716
d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa
df2e5e1df408826a2be37032abc13f89e71fae6cf50b6dfaabafb0dbaecea292
dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26
e35a53ce01739d6a718c64636da6dea3dec9475672f79a39ab42cac8a867a8ac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea9238b0e0b45fbcc34a2f202ebcd403d4b7b71ffeb75ca6157c3e8533e4c563
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef520a6b136860d5d0e179188f34c6d7167eb7c570bf68126f739932f7431761
ef7de717e56d8310ab8a5b5759026cce0ac15e478bdde1ab447ed5100ad00b8f
ef80bdf8a5fbe6f4188e41bbf081aa1c092de67e4e0848b729a73112eeb11897
f83d24e8c3b8a36dfa3fd598f1320056a5e73bd136c161fcd419c8512034663f
fae28fcab23026155838be7a52d391f3ed4e25769a154c2d15265b7adf26bfb0
fc9bca8ac977a63fbb19b21f023b3d12430ebe78c443fa9fd10f3c362b3a8bf9

arstechnica.com Open in urlscan Pro 18.216.136.68 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

75 Requests

97 %HTTPS

55 %IPv6

24 Domains

37 Subdomains

29 IPs

4 Countries

1416 kBTransfer

3867 kBSize

6 Cookies

10 Outgoing links

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

arstechnica.com Open in urlscan Pro
18.216.136.68 Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

97 %
HTTPS

55 %
IPv6

24
Domains

37
Subdomains

29
IPs

4
Countries

1416 kB
Transfer

3867 kB
Size

6
Cookies

75 HTTP transactions
5 data transactions