www.zdnet.com Open in urlscan Pro
2a04:4e42:4c::666 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/#ftag=rssbaffb68
Effective URL:
https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Submission: On December 17 via api (December 17th 2021, 6:13:25 am UTC) from GB — Scanned from GB

Summary HTTP 304 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 47 IPs in 4 countries across 29 domains to perform 304 HTTP transactions. The main IP is 2a04:4e42:4c::666, located in United States and belongs to FASTLY, US. The main domain is www.zdnet.com.
TLS certificate: Issued by R3 on October 26th 2021. Valid for: 3 months.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
20	2a04:4e42:4c:... 2a04:4e42:4c::666	54113 (FASTLY) (FASTLY)
5	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700:303... 2606:4700:3030::ac43:b431	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:26f0:6c0... 2a02:26f0:6c00:1bb::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	151.101.194.154 151.101.194.154	54113 (FASTLY) (FASTLY)
1	34.120.203.121 34.120.203.121	15169 (GOOGLE) (GOOGLE)
2	34.224.146.121 34.224.146.121	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.65.194 151.101.65.194	54113 (FASTLY) (FASTLY)
13	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
25	92.123.125.236 92.123.125.236	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a02:26f0:6c0... 2a02:26f0:6c00:2b9::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.48.241.99 52.48.241.99	16509 (AMAZON-02) (AMAZON-02)
4	52.31.222.185 52.31.222.185	16509 (AMAZON-02) (AMAZON-02)
3	65.9.64.109 65.9.64.109	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400e:803::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
18	184.72.183.173 184.72.183.173	14618 (AMAZON-AES) (AMAZON-AES)
2	3.222.76.241 3.222.76.241	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
19	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
18	2a04:4e42:4d:... 2a04:4e42:4d::666	54113 (FASTLY) (FASTLY)
3	162.247.243.147 162.247.243.147	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2 5	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
5	2.16.107.33 2.16.107.33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3 6	54.229.132.88 54.229.132.88	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400e:80c::2003	15169 (GOOGLE) (GOOGLE)
7	2600:9000:225... 2600:9000:225f:8e00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400e:80c::2004	15169 (GOOGLE) (GOOGLE)
24	34.237.34.99 34.237.34.99	14618 (AMAZON-AES) (AMAZON-AES)
1	65.9.64.94 65.9.64.94	16509 (AMAZON-02) (AMAZON-02)
3 4	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
2 4	92.123.125.44 92.123.125.44	16625 (AKAMAI-AS) (AKAMAI-AS)
3 4	37.252.173.22 37.252.173.22	29990 (ASN-APPNEX) (ASN-APPNEX)
1	142.250.27.157 142.250.27.157	15169 (GOOGLE) (GOOGLE)
20	104.244.36.20 104.244.36.20	7415 (ADSAFE-1) (ADSAFE-1)
13	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
33	2a00:1450:400... 2a00:1450:4001:812::2006	15169 (GOOGLE) (GOOGLE)
4	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
2 4	54.171.82.61 54.171.82.61	16509 (AMAZON-02) (AMAZON-02)
2	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
304	47

20 2a04:4e42:4c::666 (United States)

ASN54113 (FASTLY, US)

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3030::ac43:b431 (United States)

ASN13335 (CLOUDFLARENET, US)

static.myfinance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.myfinance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:1bb::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.194.154 (United States)

ASN54113 (FASTLY, US)

at.adtech.redventures.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.203.121 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 121.203.120.34.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.224.146.121 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-146-121.compute-1.amazonaws.com

a.myfidevs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.65.194 (United States)

ASN54113 (FASTLY, US)

confiant-integrations.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 92.123.125.236 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-125-236.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:2b9::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

02179910.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.241.99 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-241-99.eu-west-1.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.31.222.185 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-222-185.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.64.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-64-109.fra56.r.cloudfront.net

cdn.cohesionapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:803::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 184.72.183.173 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-72-183-173.compute-1.amazonaws.com

ingest.make.rvapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.222.76.241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-76-241.compute-1.amazonaws.com

taggy.cohesionapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a04:4e42:4d::666 (United States)

ASN54113 (FASTLY, US)

media-mtml.mt.rvapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.247.243.147 (United States)

ASN13335 (CLOUDFLARENET, US)

bam-cell.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.70 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.16.107.33 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-107-33.deploy.static.akamaitechnologies.com

clipcentric-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.229.132.88 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-132-88.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400e:80c::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:225f:8e00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400e:80c::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 34.237.34.99 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-34-99.compute-1.amazonaws.com

tr.clipcentric.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.64.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-64-94.fra56.r.cloudfront.net

ad.clipcentric.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.181.226 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 92.123.125.44 (Amsterdam, Netherlands) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-125-44.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.173.22 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.27.157 (United States)

ASN15169 (GOOGLE, US)
PTR: ra-in-f157.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 104.244.36.20 (United States)

ASN7415 (ADSAFE-1, US)
PTR: nyidt.adsafeprotected.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

redventuresgamdisplay60805146916.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:4001:812::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.171.82.61 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-82-61.eu-west-1.compute.amazonaws.com

samsung.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	rvapps.io ingest.make.rvapps.io media-mtml.mt.rvapps.io	20 MB
36	googlesyndication.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	1 MB
33	2mdn.net s0.2mdn.net	2 MB
33	adsafeprotected.com 3 redirects pixel.adsafeprotected.com static.adsafeprotected.com fw.adsafeprotected.com dt.adsafeprotected.com	295 KB
30	moatads.com z.moatads.com mb.moatads.com geo.moatads.com px.moatads.com	426 KB
30	doubleclick.net 5 redirects securepubads.g.doubleclick.net ad.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net bid.g.doubleclick.net googleads4.g.doubleclick.net	253 KB
25	clipcentric.com tr.clipcentric.com ad.clipcentric.com	7 KB
21	zdnet.com www.zdnet.com urs.zdnet.com	376 KB
13	moatpixel.com redventuresgamdisplay60805146916.s.moatpixel.com	3 KB
6	googletagservices.com www.googletagservices.com	168 KB
5	akamaihd.net clipcentric-a.akamaihd.net	1 MB
5	cohesionapps.com cdn.cohesionapps.com taggy.cohesionapps.com	33 KB
5	myfinance.com static.myfinance.com www.myfinance.com	67 KB
5	cookielaw.org cdn.cookielaw.org	116 KB
4	demdex.net 2 redirects samsung.demdex.net	3 KB
4	adnxs.com 3 redirects ib.adnxs.com	4 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
3	nr-data.net bam-cell.nr-data.net	2 KB
3	google.com adservice.google.com www.google.com	1 KB
3	redventures.io at.adtech.redventures.io	179 KB
3	go-mpulse.net c.go-mpulse.net	52 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	akstat.io 02179910.akstat.io	708 B
2	fastly.net confiant-integrations.global.ssl.fastly.net	93 KB
2	myfidevs.io a.myfidevs.io	166 B
1	googleapis.com fonts.googleapis.com	1 KB
1	newrelic.com js-agent.newrelic.com	17 KB
1	google.co.uk adservice.google.co.uk	792 B
1	onetrust.com geolocation.onetrust.com	392 B
304	29

	Domain	Requested by
33	s0.2mdn.net	www.zdnet.com s0.2mdn.net
24	tr.clipcentric.com	www.zdnet.com ad.clipcentric.com
21	px.moatads.com	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
20	dt.adsafeprotected.com	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
20	www.zdnet.com	www.zdnet.com
19	pagead2.googlesyndication.com	www.zdnet.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com ad.doubleclick.net tpc.googlesyndication.com fw.adsafeprotected.com www.googletagservices.com s0.2mdn.net
18	media-mtml.mt.rvapps.io	www.zdnet.com
18	ingest.make.rvapps.io	www.zdnet.com
13	redventuresgamdisplay60805146916.s.moatpixel.com
13	securepubads.g.doubleclick.net	www.zdnet.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.googletagservices.com
12	tpc.googlesyndication.com	www.zdnet.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net
7	static.adsafeprotected.com	pixel.adsafeprotected.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com
6	www.googletagservices.com	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com www.googletagservices.com
5	clipcentric-a.akamaihd.net	www.zdnet.com clipcentric-a.akamaihd.net
5	ad.doubleclick.net	2 redirects b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com www.googletagservices.com
5	cdn.cookielaw.org	www.zdnet.com
4	samsung.demdex.net	2 redirects b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com
4	googleads4.g.doubleclick.net	www.zdnet.com
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	pixel.adsafeprotected.com	2 redirects www.zdnet.com
4	geo.moatads.com	z.moatads.com
4	z.moatads.com	www.zdnet.com b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
3	googleads.g.doubleclick.net	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com
3	bam-cell.nr-data.net	www.zdnet.com
3	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com	www.zdnet.com
3	cdn.cohesionapps.com	www.zdnet.com cdn.cohesionapps.com
3	at.adtech.redventures.io	www.zdnet.com
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net
3	static.myfinance.com	www.zdnet.com
2	ade.googlesyndication.com
2	www.google.com	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com www.zdnet.com
2	fw.adsafeprotected.com	1 redirects b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
2	taggy.cohesionapps.com	www.zdnet.com
2	02179910.akstat.io	www.zdnet.com c.go-mpulse.net
2	confiant-integrations.global.ssl.fastly.net	www.zdnet.com
2	www.myfinance.com	www.zdnet.com
2	a.myfidevs.io	www.zdnet.com
1	bid.g.doubleclick.net	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
1	ad.clipcentric.com	clipcentric-a.akamaihd.net
1	fonts.googleapis.com	b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
1	js-agent.newrelic.com	www.zdnet.com
1	adservice.google.com	www.zdnet.com
1	adservice.google.co.uk	www.zdnet.com
1	mb.moatads.com	z.moatads.com
1	geolocation.onetrust.com	www.zdnet.com
1	urs.zdnet.com	www.zdnet.com
304	49

This site contains links to these domains. Also see Links.

Domain
downloads.zdnet.com
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
securityintelligence.com
www.praetorian.com
www.trendmicro.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
redventures.com
narratives.zdnet.com
privacyportal.onetrust.com
support.zdnet.com
academy.zdnet.com

Subject Issuer	Validity	Valid
*.zdnet.com R3	`2021-10-26` - `2022-01-24`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2021-06-01` - `2022-05-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-18` - `2022-06-17`	a year	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2021-06-08` - `2022-06-13`	a year	crt.sh
at.adtech.redventures.io R3	`2021-12-04` - `2022-03-04`	3 months	crt.sh
*.myfidevs.io Amazon	`2021-12-07` - `2023-01-04`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2021-02-12` - `2022-02-11`	a year	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-27` - `2022-05-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-25` - `2022-06-25`	a year	crt.sh
cdn.cohesionapps.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
*.google.co.uk GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
ingest.make.rvapps.io Amazon	`2021-09-26` - `2022-10-24`	a year	crt.sh
*.taggy.cohesionapps.com Amazon	`2021-02-27` - `2022-03-28`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-10-06` - `2022-11-07`	a year	crt.sh
*.mt.rvapps.io R3	`2021-11-14` - `2022-02-12`	3 months	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
aka.clipcentric.com R3	`2021-11-20` - `2022-02-18`	3 months	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
clipcentric.com Amazon	`2021-02-05` - `2022-03-06`	a year	crt.sh
*.adsafeprotected.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-26` - `2022-06-17`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh

This page contains 24 frames:

Primary Page: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Frame ID: E8ABA56CB58F2ABF167490512330D20A
Requests: 133 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: E05519A8BFC3C19BA2457D9DCA98603A
Requests: 2 HTTP requests in this frame

Frame: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B5C9B1FC092F8625E3E397A35EE5DC11
Requests: 1 HTTP requests in this frame

Frame: https://cdn.cohesionapps.com/cohesion/xs2.html
Frame ID: A2BA91D1E3BBC0E7C03764BFA1B794DD
Requests: 2 HTTP requests in this frame

Frame: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B0E207C031AD7634519287596C16B174
Requests: 21 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssBsv1PkNkjow_lY_UKGZNsNnGuUwbCweUQfa2Q3QVRRjZapa0jfu4kirB3XbbRqm4xHhVE9xtvtecgJtVAL-LR_aKk9tWz8fs7-ElNTo82CNq1PSmWsBAvN1BG_XG86acZi_u4VqPrKo5BI_vyBstzOh4Yl692gIfoErOwf50Ac1y5h4f93UDTBh692Ih-gXvN4m-2gsnMZTdUkId5bdtKEP6QnvqsVGCFHps-fAOwnPhQn3TGBD-kVwQfclEWJ3JUEBLqaHh2u7IzVBkOSHactSOpHfPnKDvPkoFqor8tlFCuxtaBhQ_dOmdKyZRp0EcEOPcTxQ1dVc6hesB1_Qtg&sai=AMfl-YQC9AucqywO34IWklMJ9id_XHizLpaPBXLBJf42x8bsc0HoPHEuCXrjjvqn0DYj6gxjk-ZEdLm37W796ZyFM5yF1VlXRb01IswGBV0qUmEB8GXeUPMqft7hglRU-tw&sig=Cg0ArKJSzGt8pGGUTRLlEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 957C94F75EF50F5882E1F6D74FE17965
Requests: 36 HTTP requests in this frame

Frame: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: BA09364BD6D1F93E8DD91BCF9F825352
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMShnQIQjY6qAhjrsZu9ATAB&v=APEucNVgdi1efKyESWzOegLBYe1QlA0_EeelVuoFzArfsJdQZTmQqEbyfqHv7kz3iIGP2onDDFk3EI0fDl1sQhZ0ZC2EZwbbPAqor1WyFxoC6hoBVd47ByzP7w-cCPKdu5kh3BuV3B9xkl1Y1q1Pkckyi4tuNg53aw
Frame ID: 23A697C47CB5CCB6ECE28CDE29729726
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZ2cLCtoIZCOsZ7nZiahaZ1aNYwR7mnltC-dZPAgHbcqmW3W0HOcAqokGql75NJ3uaQ4zSxd70ZF7VklR0dy3r4D2iEj9oSY29Djt-gQV19XFLTOI5W9pNaHwC8tqRyvKJ95nDXca7T6Zaa7WVkamRQoSx-Q&cry=1&dbm_d=AKAmf-AAFtLyjH1OZQKGsU5weJhskCwy6ls1s5XUBn-iXCLDvFdwmsaqc_XmBDWpXoKHvxcMY6FIOhMCjUFHUywjckYojBSG8CRvuZDMWFUcqW-763iwzW83phXKUflOWQDUNdFNyBWVpP56CjZShLn3M7uwk19I3RgIJ44gPFXNkPCsd9-KK8vFOYvhK_Kdq0rzg2vCKbxbRAtyaLB2WUnt_YKsv4xgSEal85WxzzHnDFh84_GgD64dypWzCJRdPyzb_hibvRpMrxrabfGk4cuoykGn70cVuaoqwVyRUMXTCVtRqRC2FiFZelXw7b5g6Pdl5ZN5Swb1uOjdrUi8c0gKEddFU7vMrMInqUVqyVwh3_P1l1R-JTGD5h9mI46Qli__m45XruhZOL0dpBzsU8A7ZpFGTiHrRWMaVdbeLF1E6LPsN65_BbNNG4OZtwYY2bxhStOzq4zy9D-6i50N0BrFTx4YxxeKc8nPDXVqNypsPTOnjXG2U-y4QGZCg6RP-sA6ZfisEt5EAAhK8Ku6Frh4hTj1B_vpHdXM_aJbt56S1C_MSJk0JPltw8xDlnypPV1VGPk54e7uZSjKbRlnNds1Fjrb_533tnnBH0J3q8Z4e3SwVE05_TSE-OfqYuENI-lHqJZv2Hav-2CS8xGo1oZpjlXVyvRt6F4RU7kQkWw_2q4gAH40gn2nx6-69jYwoliUWDViUyh1pOiKNl70f2TrcBbhSytVh0bzvp1AhklgnzIlCZhFPkre-7DvuCyU8YZgDgc__ttG2-hz9jhROCubOwAE3NJ0B_fK6fTPzqBOVYIT85fyWX-I4JfxZUocF3U7znfD9ZDrvDRDfQcu6YeGvfpFXyne71Ar2ZZelzh7V7VzBXJnptZWDFeiGhLMFo6vDl2sbHYrKxOEk1IHnpVKGcTWwzEhhEIYzSUILjSqoS2KyduqoQE9unr82nn5elRH80oQsVVuSWkD5F0pQ0UWRRZVh59_OzR54DKfL3S3huiNc3eDZlqDhqjZFULY0wk3ONWLxJAwrjQbe9AAnwZ-8YIG6gYO5Jux1fvL5QZobbZwObbh7IhcU86hiKPh_56s-OI4ODRASojGydhBczusZHDwTDdA2UPgxQfPcN7ZMZdV7QgDOfKFNJd7onaEjfvxblzgYgIn14uZ1yuKOUZOndw8SSQicmX22EpiQOg7bSS921xTupBOte_4pUYoYvRq4auvOK4ZDw9E6zFcP49VIyUaMuk3-S_SapCb7JrgDRTTJ9SXFcjYASe2Goqz9FPRaadgSfUA7XIFYMxCqL3GSWvYOzGWMwwOPFjdpOEhnBI4wzXSXt59PwqTVATphpOIZebF5nK9uaQsQSCil4x7bpgFSHXpkkSTGep2XvB4Bs2VD3Dv-iI4LSgbRVJDRSByIkCIZONkiI0kKwKZgLtFnGymBVAl9p5HXI1dkr7lQ6hEvptfYNoNdA_hdA4_0Km23Z3h4J99Vm0Zl2LAtUUjNUQpMCKjAadDzhn_RTnYX9t4Fnp9bna20iyyVbBb71JUqeZolSxj04mcTWV8Lej8NTl2C_ETrbeQy3r8vjoISnWt2tlQh8_RPl_cvZEmOhFS7_N-LeBfFaXZcj28oUSjSjb1TJJkUTI8zTyReSlCXadBMs03GV_zUTWreOoeDnoIyku1YheRYDpj6SEFw2_Cs7H97D8AKgxpv05QpF9a9ot4k0_EhfdzAvEAXUtCv0INNwFhY0Geih2AQiCfxBC0BKxiywM9-fCoS9vWxuyQDSNDHFHeopMkuIv-JFNdKRku233VsbnRgEMoOfNfz_shAa2EPYBloqHCY89zfCm2xT19WM9rDRMkIJX-THuMKSAwItOFUAGQf_Hs27QfNCPRnvFz4vKMgvTQPg4UJsFBYyaLPT3mHeC4dZLIQnGM5trPb7ktbx63jyIIC3oT8n2YIRoIHHDfalAVWLwx8PFQkNysscX1Y8rC8r8Fs6begC9eKUw-G3b-H-nL2yWirm_4ewMlo3A92TgBnTJPSgY8x6l69tbWzG5HT1lCxXCnWUsLtsqi7zmxWb-0Q7GhCduhz_enpLos3q4NYYSNeXNSbjoJlGzMuICVQtyVTL-N9bVX4K0QUachFVJbJbQaReNB32q1zbJRDyc_pDJJiwQqDKKGtHlciIMZRDzH2aK3gwlR9FsAV05WnwEal2aBmdjwtePTodYwG9m4NevqKKEJ2aU_z_BXqHBjju8YuTTJ2UykHEA4Yh6-qucXYPPM7ivB735oEVaxJNR3ox04JLOoUzwQ4V0TNRXbdxcibEsejqYubSQTd-7lZPMfXQ1tF_Tiuc4vX6wUnEIdQ7YjA8fyuBqgoLDJ4cTlihBTFFLPQIm8a9SkN9MYerx1qgzHlJFWyLDNxE9DrRFyIR8T5Q6lWmi_ghhy5Yp5P7sqLY3T8KX9rYQzZlQVQbb8qHX5kTYMeeurkssGR9jbwZlbw3m8hInfxK6ODdaIzL0HxWMAIi2c2gZQ4rLqSNPfncThMBGWTtPjA-45SwDjHxEmYTPaOTPUh17u0i18_89w9iTtz3AI8Gm9ByiLmqSZ3Bxy3002VIjylFt8P09jgsKeLsoMw2dxcz1XVhXzBiWrh214T1L6ZZn4yfp-whsURejc55yrKAk54D-Me2t1mVilK_U69ygg94z7vNUATlUUxoE75M4gsUXIgKeVI7XxNGaoU3-oLJC6sJklZr38w3JZn3wMcZOU44TiwEyzGTK3Z4sbksLKbKHeESZhr8anhgXz8dxFzBq4std0i8iEB2Kq185a8Ej_6XMY-e_KiNp8-Dk0IRiW0SANg7bsr8-CP_p0yT1Fa-vucTWJ3Wn5hiDi76RYD9bQ2WmoxJdkKlzqyEU6aAgQ2juiSzfUpa5vuz_jU0LZMYhZ72XBMUknZlSPVxDWzpJLgc5yZ3IDbc-yTGkpoz4qCzFZty1gMqjOOjIDC5oDZtdFUgPjZRAaqqwhiXBn_4ITpVacByVOTTsw_XXfJbIUo_sje4D1l9d1jLYk0ODmmIuNmcMtrUNAd7jqAjxDRAmdnwYDrXDgJf-nT4jRHDUVsgGDgPHnEak6wbI57-LTW8wbeIngQmchgLobQNMOILN0Nenx6yVzOyDxbb39GazT8j-lH9RBCQNaapyvYcKOVbWf8TmVNOCwS9mzod-8dcne4vic7-zDzO4zIeW6cEL1eYm-wxvWEAVCvew9c-AFLmEF58BOHgoOipooFFYY6ZyqrWWNPX6xb689y25B56zbXbYwKhvMujsC95KEszAzndv-8b-bN4lBvAEbkhL_npvYRU074fdLJ0zozSR6atm_8aWx8-GsUYij78H98wBrQxEDcSyhmHHnGsJC78D_RzIw6C7U2S2mZGQTT6gveEMzr8H3t4elDwGlEFdAPPKPNpFaFjvKVGUzneLKwIKeSULGjDjlrghmlmKnxw2eCXXkPvPtB6IvRW7wJ4xt4QWkTwH3yaQv673pwiyZDP9fzeElRgrJVn5TvYh6zrFoBZFz8czt24Tc6vaSN5kCcLhSNfiG5W9x8zc3odDxmoC6aBRQQJ2VjFOpbCXab9MLBJvnVZftsi9IdaP9jp-bezhD4Pa0kWUkSKnMvFlcQpMIORohu4bS0W2YQhc2Loa4aBzgXPvu7hTCGHqW9_iu8ZKDXHfwdB0LPje7H5dJEswe0XMId5E8BsjF_MvjB50n6nWCSugv4pQ0Q-0St_aI_yu_o-nKs0ePgoGG-xCTFKoqIFLjBi7tFYLaJTirw0A8kAyNgauXs7GMamRYjViuTPK1DyOfuSov66IqBP6IZJpBAvyv0MmTRawMfpJumln6q8k8qhPMb8oHYE3-qn0-uzK2s12-HJmYv706sEB2gNfsx_9VB4flajgYv_mGp_f3o4uVXXzhNOp236W45ogjHseY5wyLheopYep46pxICPiPZwZ5MRzglt0dLsBHNNsOL2d-lVhBiZqpuCcQTneZsoPXXgpT2GoKnCD535TSEzHkhB0SQk7QXsB_BWjv-CTumf4--0sUsDNdxHaRNSW-_whRI6nGdekpC1i7uOkfOKL4yvDY8bdlNFj8iBtcSZBrK9KcxgMjvyXU&cid=CAASFeRozEs15nMjOlPc-QEBivqj-VpTZg
Frame ID: 142832DB5348B9F7ACAF79C316AB4009
Requests: 20 HTTP requests in this frame

Frame: data://truncated
Frame ID: 772DACF50A98860955655E4FE1A1C214
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: F30015A8655F5838A1ED70D61FE019DE
Requests: 4 HTTP requests in this frame

Frame: https://clipcentric-a.akamaihd.net/user-9/resources/ad.html
Frame ID: 69B3DE7E3659582DBEB6D57659BE1D96
Requests: 1 HTTP requests in this frame

Frame: https://ad.clipcentric.com/user-9/resources/store.phtml?v200530
Frame ID: E33E0CE0D6E55E5EDDD74A7690E10EB3
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: FDD2A399694568913D6AE716BF38E615
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 03F44FFEB8E6E6E57077AF76EE79845D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B53D5305D70115AAFC5F8BB31682BB7B
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: D8FEE67589EF710EA526C8F04374182D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: CEC8F3C218C4E1FEE897399893737321
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
Frame ID: 55182E68973AFFDDC176CECEDFF1059B
Requests: 18 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
Frame ID: 01200EACC8D7FC8435C30AD9BF6C01C3
Requests: 17 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1718100BE30EE101C86D76CB6C39736C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6AE9F4AE204182650C70163AC22C1727
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js
Frame ID: A3231D9B094C6C781F7BB47532C63E9D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js
Frame ID: 9B5F5F088DB53D9B54911E780D34E775
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Suspected Iranian hackers target airline with new backdoor | ZDNet

Detected technologies

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

require.*\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

304
Requests

96 %
HTTPS

41 %
IPv6

29
Domains

49
Subdomains

47
IPs

4
Countries

26963 kB
Transfer

32545 kB
Size

38
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: https://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: https://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: https://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://securityintelligence.com/posts/nation-state-threat-group-targets-airline-aclip-backdoor/
Title: subject of the attack

Search URL Search Domain Scan URL

URL: https://www.praetorian.com/blog/using-slack-as-c2-channel-mitre-attack-web-service-t1102/
Title: Slack C2bot

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/research/19/c/new-slub-backdoor-uses-github-communicates-via-slack.html
Title: SLUB backdoor

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ZDNet/

Search URL Search Domain Scan URL

URL: https://twitter.com/zdnet

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ

Search URL Search Domain Scan URL

URL: https://redventures.com/privacy-policy.html
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://redventures.com/CMG-terms-of-use.html
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://privacyportal.onetrust.com/webform/79ba7c84-ebc2-4740-8d11-bf1cc4501e59/ae88e03f-2b16-4276-9980-27124ba4b2c1
Title: Do Not Sell My Information

Search URL Search Domain Scan URL

URL: https://support.zdnet.com/
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_pre=CM_1iveW6vQCFcqF_QcdONoGBg;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 103

https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_pre=COzMi_eW6vQCFVeS_QcdFIMCWw;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 159

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1

Request Chain 160

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbwqdlLjCgZe480XVyZzmgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1

Request Chain 161

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESELS7I6e4--Pf2RH8Zd4uUJc&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELS7I6e4--Pf2RH8Zd4uUJc%26google_cver%3D1

Request Chain 162

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjAzNjc3NDk0NjE0NDkyMzQyNA%3D%3D

Request Chain 163

https://fw.adsafeprotected.com/rfw/bgd/902252/59081166/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&ias_dspID=3&ias_campId=25634041&ias_pubId=pub-8820362605711196&ias_chanId=1&ias_placementId=15548172663&bidurl=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/&ias_dealId=1804173&adsafe_url=https%3A%2F%2Fb6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Fb6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:9c50e3b6-23e7-b7d6-6281-0b964dc67322,c:x21U8m,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-6d588df4d9-k4wh2,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:2,fm:sRPqGGW+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:17,oid:688ecbd5-5f00-11ec-8929-e642c24959fc,v:19.8.273,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D

Request Chain 170

https://pixel.adsafeprotected.com/rfw/st/903347/59128492/skeleton.js?ias_dspID=64&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&adsafe_type=abq&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&adsafe_type=df&adsafe_jsinfo=,id:88347e9b-c11f-6ae6-f5fe-e510ce5f9e41,c:x21U9Z,sl:inView,em:true,fr:true,thd:1,mn:jsserver-primary-6d588df4d9-95tkb,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,nbld:0,mtim:394,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C161%7C162%7C17,idMap:15*,pl:,rmeas:1,rend:1,renddet:IMG.qs,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,tt:rjss,et:410,oid:686745c8-5f00-11ec-871e-16fe1ba8fc2e,v:19.8.273,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/skeleton.js

Request Chain 196

https://pixel.adsafeprotected.com/rfw/st/886082/58856297/skeleton.js?ias_dspID=64&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&adsafe_type=abq&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&adsafe_type=df&adsafe_jsinfo=,id:e1259329-2c1e-d99b-76da-fbc6ea1f81f4,c:x21UdX,sl:inView,em:true,fr:true,thd:1,mn:app12ie,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:115,fm:sRPqGKQ+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,tt:rjss,et:122,oid:689051ba-5f00-11ec-a7ba-0a1e87f1382c,v:19.8.273,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/skeleton.js

Request Chain 216

https://samsung.demdex.net/event?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415 HTTP 302
https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415

Request Chain 220

https://samsung.demdex.net/event?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415 HTTP 302
https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415

304 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/ 222 KB
91 KB 1044ms
859ms Document
text/html 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f74cbe6cebaeb5c2cbd346c9e6d61b3846a661248dbc17415d24286737fa3968

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-type: text/html; charset=UTF-8
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
link: <https://www.zdnet.com/a/fly/css/core/main-61ec7c25fb-rev.css>; rel="preload"; as="style"; nopush
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-tx-id: 262ce71a-97d6-406a-926a-d59185bca0de
x-xss-protection: 1; mode=block
date: Fri, 17 Dec 2021 06:13:07 GMT
via: 1.1 varnish
cache-control: max-age=5400, private
expires: Fri, 17 Dec 2021 07:43:07 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
accept-ranges: bytes
vary: Accept-Encoding, User-Agent
content-length: 91917

GET
H2 200 main-61ec7c25fb-rev.css
www.zdnet.com/a/fly/css/core/ 304 KB
53 KB 80ms
79ms Stylesheet
text/css 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/css/core/main-61ec7c25fb-rev.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

83575e34525331ea577205e94ffcb89cb9bb5cbb6e9f1c852dacaf941276de5b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:07 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 53705
x-xss-protection: 1; mode=block
last-modified: Thu, 16 Dec 2021 20:56:56 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: text/css
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Dec 2021 20:58:43 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 19 KB
7 KB 205ms
78ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d2a74d8b25e1ccd4b1294b0b937804bc24aeea7f46edad3f3c1f91604d2708c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BXRr8anumVFsMvgN5QlueA==
age: 4866
vary: Accept-Encoding
content-length: 6508
x-ms-lease-status: unlocked
last-modified: Thu, 16 Dec 2021 21:12:11 GMT
server: cloudflare
etag: 0x8D9C0D8BA367D8A
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 33055f87-f01e-0121-20e0-f2f382000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6bee00f5aba759b9-MXP

GET
H2 200 optanon-v1.1.0.js Show response
www.zdnet.com/a/privacy/optanon/ 36 KB
10 KB 70ms
70ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 10444
x-xss-protection: 1; mode=block
last-modified: Thu, 04 Mar 2021 19:22:21 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "46e2aa30cbebb708b5fc468d57d56d8b"
strict-transport-security: max-age=31536000
content-language: en
via: 1.1 varnish
cache-control: public, max-age=86400
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 18 Nov 2021 07:05:01 GMT

GET
H2 200 controls-ce6ece0b43-rev.css
www.zdnet.com/a/fly/css/video/htmlPlayerControls/ 25 KB
4 KB 72ms
71ms Stylesheet
text/css 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-ce6ece0b43-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d32763388ba6d9bba0619b8912021d30345002aa0d5dcba3ce01a05da23f72db

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 4330
x-xss-protection: 1; mode=block
last-modified: Thu, 16 Dec 2021 20:56:57 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: text/css
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Dec 2021 20:58:43 GMT

GET
H2 200 charlie-osborne.jpg
www.zdnet.com/a/img/resize/c8ef739a72ea5f7507a32fca52940befe437ac45/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/ 924 B
1 KB 74ms
72ms Image
image/webp 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zdnet.com/a/img/resize/c8ef739a72ea5f7507a32fca52940befe437ac45/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/charlie-osborne.jpg?width=50&height=50&fit=crop&auto=webp

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f6a1d1301a41d925a220c3cac7f9d927356bff1c809259b16601325663de156d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 varnish
fastly-io-info: ifsz=11429 idim=350x250 ifmt=jpeg ofsz=924 odim=50x50 ofmt=webp
x-goog-meta-x-goog-reserved-source-generation: 1588631330699120
fastly-stats: io=1
content-length: 924
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "+syrtNFOJHcaa/T8DZP/qt2kgH1Jbet5hqlMrCh94N4"
vary: Accept-Encoding, Accept
strict-transport-security: max-age=31536000
content-language: en
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
content-type: image/webp
expires: Mon, 06 Dec 2021 09:31:39 GMT

GET
H2 200 charlie-osborne.jpg
www.zdnet.com/a/img/resize/ae8b429306581e2c4e0430de956e3cf4ec97dd0d/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/ 1 KB
2 KB 69ms
68ms Image
image/webp 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zdnet.com/a/img/resize/ae8b429306581e2c4e0430de956e3cf4ec97dd0d/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/charlie-osborne.jpg?width=70&height=70&fit=crop&auto=webp

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c98713a27c661e04f9aecf37a7794088451f73bab4b9bb615ed29ff5a5fd75e1

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 varnish
fastly-io-info: ifsz=11429 idim=350x250 ifmt=jpeg ofsz=1362 odim=70x70 ofmt=webp
x-goog-meta-x-goog-reserved-source-generation: 1588631330699120
fastly-stats: io=1
content-length: 1362
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "WJx6jKkdQae/xT/2CLMZ+wj9F2L05l7GfidXOzIiG/Q"
vary: Accept-Encoding, Accept
strict-transport-security: max-age=31536000
content-language: en
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
content-type: image/webp
expires: Mon, 06 Dec 2021 09:31:39 GMT

GET
H2 200 require-2.1.2.js Show response
www.zdnet.com/a/fly/js/libs/ 16 KB
6 KB 72ms
71ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 6169
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Dec 2021 16:01:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "ef4ea9601b2a10c6fa6a76408a1d97b4"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Dec 2021 18:20:59 GMT

GET
H2 200 inlineMedia_core.js Show response
static.myfinance.com/widget/ 184 KB
63 KB 240ms
79ms Script
application/javascript 2606:4700:3030::ac43:b431
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.myfinance.com/widget/inlineMedia_core.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c2898711aa44688968b5769b7ca3a50be196c4897657ab6ce34f215b07f455d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5121
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: RT6K9Z0XQ3DPJ6CZ
x-amz-id-2: Pya7FZQdKlO16gMDpW/ngBLpcsX1DR+Q0180fMXNiKp53kl6BR/m6P//jHst/b0hCPOosnJ5wKQ=
last-modified: Thu, 09 Dec 2021 19:58:40 GMT
server: cloudflare
etag: W/"874805badaa992bae7fba35738ee6edc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4jabOurAEeCCxAmvefcWx%2BnyF9u6vkSlJtdJgYoA7crAtxnjyquOujlPegR0y8UrdF4CpwqKcwX6Hr03%2FwzYFzTiJ4PU00POfYesDkHVgTvoKaw%2FAUcih3SKaUNC7Vglc%2FytvnC1q8BdGT%2Btlhj%2BZEEthA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6bee00f68aae0e1e-MXP

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame E055 205 KB
50 KB 242ms
87ms Script
application/javascript 2a02:26f0:6c00:1bb::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:08 GMT
Content-Encoding: br
Last-Modified: Thu, 14 Oct 2021 03:09:47 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 50393

GET
DATA 200
OK truncated
/ 31 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 logo.png
www.zdnet.com/a/fly/1639688064-asset/bundles/zdnetcss/images/core/ 4 KB
4 KB 70ms
69ms Image
image/png 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zdnet.com/a/fly/1639688064-asset/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/css/core/main-61ec7c25fb-rev.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/a/fly/css/core/main-61ec7c25fb-rev.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src https://*.zdnet.com:*
via: 1.1 varnish
last-modified: Thu, 16 Dec 2021 19:54:03 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
date: Fri, 17 Dec 2021 06:13:08 GMT
vary: Accept-Encoding, Accept
content-type: image/png
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 4105
x-xss-protection: 1; mode=block
expires: Thu, 23 Dec 2021 20:08:24 GMT

GET
H2 200 Semibold.woff2
www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 74ms
73ms Font
font/woff2 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Origin: https://www.zdnet.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 varnish
vary: Accept-Encoding, Accept
content-length: 20344
x-xss-protection: 1; mode=block
last-modified: Fri, 12 Nov 2021 15:35:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "a96ff4477074c6395b7305d2d98fde8e"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Nov 2022 18:20:56 GMT

GET
H2 200 Regular.woff2
www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 78ms
78ms Font
font/woff2 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Origin: https://www.zdnet.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 varnish
vary: Accept-Encoding, Accept
content-length: 20256
x-xss-protection: 1; mode=block
last-modified: Fri, 12 Nov 2021 15:35:30 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "2d636d9395b2da27ce67040250333ca4"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Nov 2022 18:20:56 GMT

GET
H2 200 inlineMedia.css
static.myfinance.com/widget/ 3 KB
2 KB 192ms
72ms Stylesheet
text/css 2606:4700:3030::ac43:b431
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.myfinance.com/widget/inlineMedia.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2964
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: K1SGYZQKQY2VZV1C
x-amz-id-2: FikmsiGhSS5gzeL60pjv0GRZ6NLqsXGiwSmM5rUXs1pJpumAgosw1yHy6298IGQ7I5kGjFu0i0c=
last-modified: Mon, 12 Jul 2021 14:22:18 GMT
server: cloudflare
etag: W/"528a38ce39fc58a866c1226253bbb189"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mr0Ogn1PkKBtBehYI3SunFbD6fPVPmd7Aswhvphz27FIDUXb%2BX8ifH%2Fv0EOFGHoFCXCyVGOcn2qxBkcqYIWyt%2FruygoVoVWbDPpFIErSzg5ObjXFY2y7Wx4Qbjp0o4Tlmi%2BFo8i%2Fu3%2BbaxUDjYBJv3hgnA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6bee00f68aaf0e1e-MXP

GET
H2 200 main.default.js Show response
www.zdnet.com/a/fly/046431-fly/js/ 223 KB
70 KB 64ms
63ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/046431-fly/js/main.default.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

022185811a029208da14948f296e29ce3ebb9aa90dfaf6a14570245e89a80165

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 71889
x-xss-protection: 1; mode=block
last-modified: Thu, 16 Dec 2021 20:56:48 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Dec 2021 20:58:44 GMT

GET
H2 200 e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response
cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/ 3 KB
2 KB 206ms
70ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: xkIaWO5Hr0+rNu9IdoYHdw==
age: 1353
vary: Accept-Encoding
content-length: 1425
x-ms-lease-status: unlocked
last-modified: Thu, 08 Jul 2021 15:15:53 GMT
server: cloudflare
etag: 0x8D94223473B0939
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 06042b04-c01e-000f-0c15-b63510000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6bee00f71d7d59e9-MXP
expires: Fri, 17 Dec 2021 10:13:08 GMT

GET
H2 200 bidbarrel-zdnet-rv.min.js Show response
at.adtech.redventures.io/lib/dist/prod/ 607 KB
177 KB 135ms
37ms Script
application/javascript 151.101.194.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.154 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6c0cd7b80611259d4ccce9165e8b5dd062aad43e3e3e19a404fe967c49795d03

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 271d531da7ba45d7dadd2b5c9f93148d.cloudfront.net (CloudFront), 1.1 varnish
age: 142
x-cache: Hit from cloudfront, HIT
content-encoding: gzip
content-length: 180330
x-served-by: cache-lcy19275-LCY
last-modified: Thu, 28 Oct 2021 17:15:17 GMT
server: AmazonS3
x-timer: S1639721588.352287,VS0,VE6
etag: "873be44731952ce6844f825d0be702dd"
vary: Accept-Encoding, Origin
content-type: application/javascript
cache-control: max-age=900, public, must-revalidate
x-amz-cf-pop: LHR52-C1
accept-ranges: bytes
x-amz-cf-id: hu1TdFhOr9ZnbcevVDaO2Ogti5d3P4x-vlwUokwtf7Z5yjI8MwyTwQ==
x-cache-hits: 1

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 213ms
127ms Script
application/javascript 34.120.203.121
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://urs.zdnet.com/sdk/urs.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

121.203.120.34.bc.googleusercontent.com

Software

Resource Hash

fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 google
last-modified: Tue, 12 Jan 2021 17:00:48 GMT
etag: "5ffdd5c0-c803"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
accept-ranges: bytes
alt-svc: clear
content-length: 51203

GET
H2 200 mpulse-1.0.2.js Show response
www.zdnet.com/a/fly/js/libs/ 61 KB
12 KB 64ms
64ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 12449
x-xss-protection: 1; mode=block
last-modified: Mon, 13 Dec 2021 22:34:51 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "148d7e6acc80b32c08a3cbf8e3164307"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Dec 2021 05:39:11 GMT

GET
H2 200 inlineMedia.css
static.myfinance.com/widget/ 3 KB
1 KB 73ms
73ms Stylesheet
text/css 2606:4700:3030::ac43:b431
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.myfinance.com/widget/inlineMedia.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/#ftag=rssbaffb68

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2964
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: K1SGYZQKQY2VZV1C
x-amz-id-2: FikmsiGhSS5gzeL60pjv0GRZ6NLqsXGiwSmM5rUXs1pJpumAgosw1yHy6298IGQ7I5kGjFu0i0c=
last-modified: Mon, 12 Jul 2021 14:22:18 GMT
server: cloudflare
etag: W/"528a38ce39fc58a866c1226253bbb189"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l9LbpDjeNEy54EiVp%2Fjog2iDa4FbhdVh3x8xhrvzjvU9txCEZD54g0vLfeSj6ythn4K%2FT0wc%2FeYWzQM8GgSRJvrykaLYPHFhEtczlZV8ibP4M4K2gVkSd4DlzdEjpWQ1h%2B%2BqbFgYIbhytvP7QbZfoZ%2Fn8g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6bee00f6faf50e1e-MXP

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 210ms
79ms XHR
application/json 2a02:26f0:6c00:1bb::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1639721588329&s=b75d307a0b48bbac292c095e3faa073112eda95f66146caa83a967b1fd138590
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2ac1b04d08bfbf760a3189bb92b657724f3d701ec3a2cd678e8997f953b643ae

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 879

OPTIONS
H2 204 record
a.myfidevs.io/ Frame 0
0 376ms
117ms Preflight 34.224.146.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.myfidevs.io/record
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.146.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-146-121.compute-1.amazonaws.com
Software: Python/3.7 aiohttp/3.7.4.post0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-api-key
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST
access-control-allow-headers: *
server: Python/3.7 aiohttp/3.7.4.post0

POST
H2 204 record Show response
a.myfidevs.io/ 0
166 B 144ms
144ms XHR
text/plain 34.224.146.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.myfidevs.io/record
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.146.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-146-121.compute-1.amazonaws.com
Software: Python/3.7 aiohttp/3.7.4.post0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
x-api-key: yuH27H1QId6afXAojow6Tafi7Vw9v1spaLD5Yznw
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:08 GMT
access-control-allow-credentials: true
server: Python/3.7 aiohttp/3.7.4.post0
access-control-allow-headers: *
access-control-allow-methods: POST

POST
H3 200 v1.5 Show response
www.myfinance.com/api/au/ 1 KB
1 KB 416ms
349ms XHR
application/json 2606:4700:3030::ac43:b431
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvc3VzcGVjdGVkLWlyYW5pYW4taGFja2Vycy10YXJnZXQtYWlybGluZS13aXRoLW5ldy1iYWNrZG9vci8=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0672584c04dcfe018471290e9cd86a951af6801fd6b2f8449bb70d9f9995fb3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-type: application/json
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
allow: POST, GET
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B6z94CBJazADHNdpbn%2FOWHbLwtYzULe9i5KI142iI7wAj1oMwzLXxr78o%2B21bgfzmdg24j8ax22novb8zT3G1CuOEmnNH8TzkcLhY6v866TKPx%2B534u2OTfvTKGDvlyR%2BtMpFWl4WWtlmScSPzHIuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-language: en-us
access-control-allow-origin: https://www.zdnet.com
vary: Accept, Accept-Language, Origin, Cookie
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6bee00fd7e34375f-MXP
expires: Fri, 17 Dec 2021 06:13:09 GMT

OPTIONS
H2 200 v1.5
www.myfinance.com/api/au/ Frame 0
0 875ms
710ms Preflight
text/html 2606:4700:3030::ac43:b431
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvc3VzcGVjdGVkLWlyYW5pYW4taGFja2Vycy10YXJnZXQtYWlybGluZS13aXRoLW5ldy1iYWNrZG9vci8=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-type: text/html; charset=utf-8
vary: Origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.zdnet.com
access-control-allow-headers: x-requested-with, content-type, accept, origin, authorization, x-csrftoken, x-api-key, Access-Control-Allow-Origin
access-control-allow-methods: DELETE, GET, OPTIONS, PATCH, POST, PUT
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JauCvcul1DjLrUjKJIJ5r43mab5t68m41h5gORP4VO46lveJueMeK4vR65hTXxi%2FN4FMX2W6XxDm1XGMMu8BSv9tl9JUDgkV0y5NHSlSmVS8cvSPh1%2Bd9q9D02Z7oIppZOr%2Bxu2T7SuNmeUheLVvNw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6bee00f88fe53751-MXP
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 188 B
392 B 197ms
71ms Script
text/javascript 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43327015c42ac1cbf9175f94b64efebb06ae71ad1d006e813d0292f37d987f9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6bee00f859b3375e-MXP

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame E055 2 KB
1 KB 199ms
72ms XHR
application/json 2a02:26f0:6c00:1bb::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5465739&v=1.720.0&if=&sl=0&si=4df8adf1-31fa-4ee8-96b1-8342fe8e5359-r48x9v&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 60cdd33bbc2dc12429ba1c6e704854dc9cc50feb06f9d05f606a54ad689990fb

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 805

OPTIONS
H2 200 diff
at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame 0
0 194ms
133ms Preflight
text/html 151.101.194.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: cat,content-type,variant,version
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-origin: https://www.zdnet.com
access-control-allow-headers: *
allow: GET,HEAD
etag: W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg"
x-cloud-trace-context: be3ff3f98f8224d7d788fb98243af0b1
server: Google Frontend
accept-ranges: bytes
date: Fri, 17 Dec 2021 06:13:08 GMT
via: 1.1 varnish
x-served-by: cache-lcy19261-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1639721589.581464,VS0,VE101
vary: Accept-Encoding, Origin
content-length: 8

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/ 167 KB
33 KB 105ms
30ms Script
text/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 226d5c0c4002cd272342b9fe3647b28414eecef6bb2a38721d2630298cb91733

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:08 GMT
Content-Encoding: gzip
Age: 1546
X-Cache: HIT
Connection: keep-alive
Content-Length: 32758
x-amz-id-2: I+n2qTivAeUmUI/PI8gDdj1i5OkItgcr42xVk5IDwufecxLX3V3R+dBWdFXRgCPwa6xS4+Hgxvo=
X-Served-By: cache-lcy19235-LCY
Last-Modified: Fri, 17 Dec 2021 05:35:31 GMT
Server: AmazonS3
X-Timer: S1639721589.567003,VS0,VE0
ETag: "5c676657efff280c5316705b6bf93d1a"
x-amz-request-id: 7JQ0SG6RTWCFK9NY
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 29

GET
H2 200 diff Show response
at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ 26 KB
3 KB 33ms
33ms Fetch
application/json 151.101.194.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

3e279129e0b32c21501807eddb0c582841a0536e6dac62169361c51d5a9baed1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

cat: 5zTciER5s
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
variant: core
version: rv2.25.6

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
age: 187
x-dns-prefetch-control: off
x-cache: HIT
ttl: 900s
content-length: 2720
x-xss-protection: 1; mode=block
x-served-by: cache-lcy19261-LCY
access-control-allow-origin: *
server: Google Frontend
x-timer: S1639721589.713264,VS0,VE0
x-frame-options: SAMEORIGIN
date: Fri, 17 Dec 2021 06:13:08 GMT
x-download-options: noopen
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
via: 1.1 varnish
x-cloud-trace-context: a8a503376e28f57aa3903199d87a8ba8
cache-control: max-age=900
etag: W/a2d3576aa9cd593699dde9d75b9183cf051d0dcf
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 1

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 148ms
49ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

2be99b99f418219be8ca7a986038e1a94c5df5b2c91a0c0d9ee35552fbb8fde8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1073 / 84 of 1000 / last-modified: 1639397097"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26915
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 17 Dec 2021 06:13:08 GMT

GET
H2 200 article-6ebc50982c-rev.js Show response
www.zdnet.com/a/fly/js/pages/ 102 KB
26 KB 64ms
64ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/pages/article-6ebc50982c-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5b6e97cf069d0d1a67390ad12ef50237963c77addfd1c8f15399b916993dd143

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 26736
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Dec 2021 15:00:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "077e6dbcc2328e1aabe9b3b472aa6e18"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Dec 2021 15:23:17 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.20.0/ 376 KB
84 KB 79ms
78ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: jOOTzA5W9ewbfwCUPpt/mw==
age: 314
vary: Accept-Encoding
content-length: 86053
x-ms-lease-status: unlocked
last-modified: Wed, 07 Jul 2021 06:41:48 GMT
server: cloudflare
etag: 0x8D941124BEC2620
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 4aacb79a-501e-00a0-26ea-e71780000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6bee00f8c8ad59b9-MXP

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/ 189 KB
61 KB 29ms
29ms Script
application/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 80da370ad41bee2716b42d1583e139eac39f5c7c243c5fe6439b9754013116c6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:08 GMT
Content-Encoding: gzip
Age: 646
X-Cache: HIT
Connection: keep-alive
Content-Length: 61460
x-amz-id-2: zkIsG9wm/LASkcpeayS8VKA+SOOKeZ355p+9CTm5iLUNO9lHp21aoQYebJ3ZPIg95F1v1iMB64o=
X-Served-By: cache-lcy19235-LCY
Last-Modified: Thu, 02 Dec 2021 17:00:39 GMT
Server: AmazonS3
X-Timer: S1639721589.631008,VS0,VE0
ETag: "0bad6e8b774e2623401e436c2a44f48e"
x-amz-request-id: 4Y00RA2Z8YVMM02N
Via: 1.1 varnish
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 262

GET
H3 200 pubads_impl_2021120601.js Show response
securepubads.g.doubleclick.net/gpt/ 348 KB
117 KB 106ms
56ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119476
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 09:34:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 17 Dec 2021 06:13:08 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 233 B
160 B 100ms
51ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

8884ad54b3b16ad4e66af3377c4b475899c1c70807bb0bc3eca9227a0b09444b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135
x-xss-protection: 0
expires: Fri, 17 Dec 2021 06:13:08 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/redventuresgamheader644747280705/ 240 KB
82 KB 145ms
39ms Script
application/x-javascript 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ba5c9b5823ef1377da70e73357b85ef2dca7ade9afe70c93d0aa163c61c9bf03

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
last-modified: Thu, 02 Dec 2021 16:10:34 GMT
server: AmazonS3
x-amz-request-id: 7QPAD81JY34WPX3N
etag: "33d2b31f29685690d6e2e3d016555f04"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=9465
accept-ranges: bytes
content-length: 83699
x-amz-id-2: UBk9GShNaRBtHh7JLeWEEE/c3rAn9HqWSwWdpu1x1YY7LMAqWoFKAoY7CVxZCMbeCyJCGpPNjjM=

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/ 93 KB
20 KB 71ms
71ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: AlmWtxV11YCExQkuyz0PJA==
age: 2689
vary: Accept-Encoding
content-length: 20136
x-ms-lease-status: unlocked
last-modified: Thu, 08 Jul 2021 15:15:59 GMT
server: cloudflare
etag: 0x8D942234AE979B3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 3343f274-d01e-0054-6315-b6326c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6bee00fa5afb59e9-MXP
expires: Fri, 17 Dec 2021 10:13:08 GMT

GET
H/1.1 204
No Content / Show response
02179910.akstat.io/ 0
354 B 212ms
70ms XHR
image/gif 2a02:26f0:6c00:2b9::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://02179910.akstat.io/?h.pg=article&h.ab=seamless_c_1&when=1639721588816&cdim.Site_View=desktop&t_other=custom4%7C1048&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=c288a348071f03249b3b6918f2038a5176d3415b-37d61de2-2192eff8&h.t=1639721588492&http.initiator=api&rt.start=api&rt.si=930bcf57-e584-4a05-a6fb-85d8447496ad&rt.ss=1639721589766&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:09 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.20.0/assets/ 13 KB
3 KB 70ms
70ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 17 Dec 2021 06:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: /OL7qnwFOarng5AW29V9Pw==
age: 5117830
vary: Accept-Encoding
content-length: 2950
x-ms-lease-status: unlocked
last-modified: Wed, 07 Jul 2021 06:41:42 GMT
server: cloudflare
etag: 0x8D94112485FC2D3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: aa0c218f-101e-00ca-536c-c44b2b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6bee00fb0c1059e9-MXP

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 383 B
558 B 248ms
67ms Script
text/html 52.48.241.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&callback=MoatNadoAllJsonpRequest_6510537
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.241.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-48-241-99.eu-west-1.compute.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: ebce81fff4ecfa438572d849a07d740d774a7cd178d17ea371957cf079835ab0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "60d7d7aec4503b0397165e56f24de039126a8f9a"
content-length: 383
content-type: text/html; charset=UTF-8

GET
H2 200 n.js Show response
geo.moatads.com/ 110 B
285 B 209ms
44ms Script
text/html 52.31.222.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=0&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639721589022&de=754262226043&m=0&ar=8ab009d7785-clean&iw=04a0275&q=1&cb=0&cu=1639721589022&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A1216%3A1216%3A0%3A1207&jk=-1&jm=-1&fs=195979&na=819794148&cs=0&ord=1639721589022&jv=927875923&callback=DOMlessLLDcallback_6510537
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.222.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-222-185.eu-west-1.compute.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: 72c20ec0159a5b3d9ba18d2a376bd6f955a9d045f782dedda0740e69c1523fde

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "c1b5acbddd836db00ef70c80272d94c7c1ed3c51"
content-length: 110
content-type: text/html; charset=UTF-8

GET
H2 200 n.js Show response
geo.moatads.com/ 112 B
286 B 209ms
45ms Script
text/html 52.31.222.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=0&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639721589022&de=754262226043&m=0&ar=8ab009d7785-clean&iw=04a0275&q=2&cb=0&cu=1639721589022&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A1216%3A1216%3A0%3A1207&jk=-1&jm=-1&fs=195979&na=579651867&cs=0&callback=MoatDataJsonpRequest_6510537
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.222.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-222-185.eu-west-1.compute.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: 6351610f9cc19ebc631d437b6869af14eb71ae6f466d4901b2a841f49d6bdcff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "dc365a418d8bb1c60808fda7c627c72f86a2c7b6"
content-length: 112
content-type: text/html; charset=UTF-8

GET
H2 200 cohesion-latest.min.js Show response
cdn.cohesionapps.com/cohesion/ 77 KB
22 KB 166ms
49ms Script
text/javascript 65.9.64.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.64.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-64-109.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d5246d5f81b078b8d850b3fbe4ac7c44d05c0755ea14786c6fee453e6805fff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
etag: W/"9f7be06169d1d8c9558378c9b8f53586"
last-modified: Tue, 14 Dec 2021 17:07:13 GMT
server: AmazonS3
age: 47150
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
date: Thu, 16 Dec 2021 17:07:20 GMT
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: DT6OgBiNxLSdaim8twaY60ZtTOmvo4wBc5XgkANkA-MODIEoFAJuag==

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 141ms
50ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 119ms
41ms Script
application/javascript 2a00:1450:400e:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:803::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
11 KB 379ms
378ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4411792276628597&correlator=2225427828494739&output=ldjh&impl=fifs&eid=31063915%2C44756716%2C44755509&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211217&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x66%7C5x5&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253D4f317b9f-c636-495b-a0f5-574274c94874%257Cpv%253D1&eri=1&cust_params=m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dsecurity%26mfr%3Dslack%252Cibm%26tag%3Dcyber-security%252Ctarget%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dsuspected-iranian-hackers-target-airline-with-new-backdoor%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D6%26session%3Db%26pv%3D1%26vguid%3D4f317b9f-c636-495b-a0f5-574274c94874&cookie_enabled=1&bc=31&abxe=1&lmt=1639721589&dt=1639721589204&dlt=1639721587938&idt=970&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=50&adks=3529097836&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100&msz=1600x100&ga_vid=1751692224.1639721589&ga_sid=1639721589&ga_hid=125441962&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

370b3675e73c3446505b967ae0bf66aaa6c05081961f818e6c493d39333689e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10920
x-xss-protection: 0
google-lineitem-id: 5840893800
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138375198146
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B5C9 6 KB
4 KB 154ms
48ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 17 Dec 2021 06:13:09 GMT
expires: Sat, 17 Dec 2022 06:13:09 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
13 KB 700ms
700ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4411792276628597&correlator=1801157382997401&output=ldjh&impl=fifs&eid=31063915%2C44756716%2C44755509&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211217&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Dtop%26sl%3Dmpu-plus-top%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253D4f317b9f-c636-495b-a0f5-574274c94874%257Cpv%253D1&eri=1&cust_params=m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dsecurity%26mfr%3Dslack%252Cibm%26tag%3Dcyber-security%252Ctarget%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dsuspected-iranian-hackers-target-airline-with-new-backdoor%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D6%26session%3Db%26pv%3D1%26vguid%3D4f317b9f-c636-495b-a0f5-574274c94874&cookie_enabled=1&bc=31&abxe=1&lmt=1639721589&dt=1639721589237&dlt=1639721587938&idt=970&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=450&adks=1139850431&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x280&msz=370x30&ga_vid=1751692224.1639721589&ga_sid=1639721589&ga_hid=125441962&ga_fc=false&fws=4&ohw=370&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

f538679c8993e0baddbc2ea3f337621ff233da76626d3b80c5dec8d8164c7d0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13627
x-xss-protection: 0
google-lineitem-id: 5848202531
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138373623368
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
14 KB 522ms
522ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4411792276628597&correlator=4315124089760967&output=ldjh&impl=fifs&eid=31063915%2C44756716%2C44755509&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211217&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&prev_scp=pos%3Dmiddle%26sl%3Dmpu-middle%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253D4f317b9f-c636-495b-a0f5-574274c94874%257Cpv%253D1&eri=1&cust_params=m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dsecurity%26mfr%3Dslack%252Cibm%26tag%3Dcyber-security%252Ctarget%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dsuspected-iranian-hackers-target-airline-with-new-backdoor%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D6%26session%3Db%26pv%3D1%26vguid%3D4f317b9f-c636-495b-a0f5-574274c94874&cookie_enabled=1&bc=31&abxe=1&lmt=1639721589&dt=1639721589239&dlt=1639721587938&idt=970&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1333&adks=3640736402&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x30&msz=370x30&ga_vid=1751692224.1639721589&ga_sid=1639721589&ga_hid=125441962&ga_fc=false&fws=4&ohw=370&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

ade4a225c8f67f6d546600cadf4eacaab9b038b30acf18312838eef9154e7296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13946
x-xss-protection: 0
google-lineitem-id: 5858081027
pragma: no-cache
server: cafe
google-creative-id: 567370253023
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
10 KB 177ms
177ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4411792276628597&correlator=746045871515365&output=ldjh&impl=fifs&eid=31063915%2C44756716%2C44755509&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211217&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=320x50%7C11x11&fluid=height&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FLL%257CT-1000%26iid%3Dunit%253Dsharethrough-top%257Cvguid%253D4f317b9f-c636-495b-a0f5-574274c94874%257Cpv%253D1&eri=1&cust_params=m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dsecurity%26mfr%3Dslack%252Cibm%26tag%3Dcyber-security%252Ctarget%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dsuspected-iranian-hackers-target-airline-with-new-backdoor%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D6%26session%3Db%26pv%3D1%26vguid%3D4f317b9f-c636-495b-a0f5-574274c94874&cookie_enabled=1&bc=31&abxe=1&lmt=1639721589&dt=1639721589241&dlt=1639721587938&idt=970&frm=20&biw=1600&bih=1200&oid=2&adxs=215&adys=1434&adks=2408233683&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x150&msz=770x0&ga_vid=1751692224.1639721589&ga_sid=1639721589&ga_hid=125441962&ga_fc=false&fws=4&ohw=770&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

edbd713299a6a4e9fbb2ab92ba53e61a9bfcd3e05366bf760384c229907365f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10152
x-xss-protection: 0
google-lineitem-id: 5822723755
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138370913061
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 354ms
113ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 353ms
113ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 350ms
114ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 350ms
115ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 349ms
114ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 137 B
270 B 126ms
124ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 159153884138dfceca944de3cacf5b3c26bd6769af705b782ef4530de86b5906

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 137
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 126ms
124ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 4f837b85045ca3fb8f7febcf4d79ee007f5103fd5175ca65f5d80fefda2bc9cf

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 132ms
131ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 43b55e5e90420d26edbfb956f3f131888eb49e847a8b8b911ad9ae289665701a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 136ms
135ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 25d1232c03be7a132e5ae8165edb085f2ae958244ecbe73d3a4ae9b123fc3c01

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 146ms
144ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: fbbbdd947c9901b0ecb0efdd93da5e83cc0a129f7ab01b2eae4b250808921c66

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

GET
H2 200 xs1.html Show response
cdn.cohesionapps.com/cohesion/ Frame A2BA 2 KB
1 KB 40ms
40ms Document
text/html 65.9.64.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cohesionapps.com/cohesion/xs1.html
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.64.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-64-109.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

content-type: text/html
last-modified: Tue, 14 Dec 2021 17:07:14 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: null
server: AmazonS3
content-encoding: gzip
date: Thu, 16 Dec 2021 17:07:28 GMT
etag: W/"10b2c1751c2247b1aeccc91060f971cf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: HUbHZYju8GHN5KlLWFzinfdygSGxxyio85LiH7R_KXQrFwugouN1ZA==
age: 47142

GET
H2 200 public Show response
taggy.cohesionapps.com/implementations/ 9 KB
9 KB 122ms
122ms XHR
application/json 3.222.76.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://taggy.cohesionapps.com/implementations/public
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-241.compute-1.amazonaws.com
Software: / Express
Resource Hash: 13631760fe58e5e9c2cf16890b9869a78629cb3769f552fb3b0eaf3fba8e934e

Request headers

Source-Key: src_1kYsAcdpfzbZ8UlNLYht1RPg3m2
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Page-URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/#ftag=rssbaffb68
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
x-powered-by: Express
etag: W/"23f1-I/Ne1r04eidCtHXfz5YfX2yJL70"
content-length: 9201
content-type: application/json; charset=utf-8

OPTIONS
H2 204 public
taggy.cohesionapps.com/implementations/ Frame 0
0 374ms
116ms Preflight 3.222.76.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://taggy.cohesionapps.com/implementations/public
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-241.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type,page-url,source-key
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
vary: Access-Control-Request-Headers
access-control-allow-headers: content-type,page-url,source-key

GET
H2 200 xs2.html Show response
cdn.cohesionapps.com/cohesion/ Frame A2BA 473 B
835 B 41ms
41ms Document
text/html 65.9.64.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cohesionapps.com/cohesion/xs2.html
Requested by: Host: cdn.cohesionapps.com
URL: https://cdn.cohesionapps.com/cohesion/xs1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.64.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-64-109.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://cdn.cohesionapps.com/cohesion/xs1.html

Response headers

content-type: text/html
content-length: 473
last-modified: Tue, 14 Dec 2021 17:07:14 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Thu, 16 Dec 2021 17:07:20 GMT
etag: "ffa03bed298484a7755ca23c5431cb28"
x-cache: Hit from cloudfront
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: kX5m67r7kykCr1slKtEHTCS-CixpCWSLz-DwtCesYNemgZbV6BwvFw==
age: 47150

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 237ms
114ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 237ms
115ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 162ms
160ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: c6aba455f529f02dcb316748e648dab7f24e686165f69e2c42c00c6e68ac42b8

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 149ms
148ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 434e083f554789f0710b60942dd0845c4531b35735779a128c2601fe7ebb8ad3

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

GET
H2 200 nr-spa-1212.min.js Show response
js-agent.newrelic.com/ 44 KB
17 KB 102ms
29ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1212.min.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: wY72Ah.NJX5KzzqRFK3uhSo3Jh07tDe4
content-encoding: gzip
etag: "8bd93bf0ecb2f4e971a2055a41402bb6"
x-amz-request-id: NHQR3V1VBEEMR1KY
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 16636
x-amz-id-2: jXQQBiIqYgRmrFwfaD7K63XkExa87hXNwd65t7PPhjwR+R3OYwO9X0pCqKv7h2p1yrmpQ/UyVGA=
x-served-by: cache-lcy19252-LCY
last-modified: Thu, 04 Nov 2021 21:16:16 GMT
server: AmazonS3
x-timer: S1639721589.485134,VS0,VE0
date: Fri, 17 Dec 2021 06:13:09 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 1665

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 147ms
53ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021120601&st=env

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c240d89b45c7946756fead01002bcf47bb154c99708fd92f2399941e89f6380

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8525
x-xss-protection: 0

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
1 KB 189ms
189ms XHR
application/json 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

309c7f77b36ad8f0ecb6278afb0cf7bf91f525b2053ab757246a07e2879fe32d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-NewRelic-ID: VgEBVlJWCRAGXVRVDwMDUlc=
tracestate: 78034@nr=0-1-2767451-695782612-250391790b98340d----1639721589423
traceparent: 00-edf1e3ac94fb3193446969e7235d5310-250391790b98340d-01
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMjUwMzkxNzkwYjk4MzQwZCIsInRyIjoiZWRmMWUzYWM5NGZiMzE5MzQ0Njk2OWU3MjM1ZDUzMTAiLCJ0aSI6MTYzOTcyMTU4OTQyMywidGsiOiI3ODAzNCJ9fQ==
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
X-Requested-With: XMLHttpRequest

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 17 Dec 2021 05:54:16 GMT
vary: Accept-Encoding, User-Agent
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-newrelic-app-data: PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgNXVFMUHgFIQ1QHVA9WXAgHCgYCVAcGAQ9AFF5VXkAAZA==
x-frame-options: SAMEORIGIN
date: Fri, 17 Dec 2021 06:13:09 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 98cc50f4-f7f0-4e80-894a-2fcf7e329ebd
content-type: application/json
via: 1.1 varnish
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 17 Dec 2021 07:24:16 GMT

GET
H2 200 track-cwv-72dfb3ae38-rev.js Show response
www.zdnet.com/a/fly/js/components/ 239 B
313 B 73ms
73ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/components/track-cwv-72dfb3ae38-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9b7909cb9edd007095b41a13617b66208e4210fff9c5e411a7db116efefc8e71

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 199
x-xss-protection: 1; mode=block
last-modified: Wed, 15 Dec 2021 17:45:18 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "a5d265f628012577e91fdf890dd49e32"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Dec 2021 22:42:12 GMT

GET
H2 200 author-modal-d55d4e857c-rev.js Show response
www.zdnet.com/a/fly/js/components/ 573 B
447 B 71ms
70ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/components/author-modal-d55d4e857c-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

06c00948dd5d4c3109c9e00bb6c44938e1251feae65e2b7c2591f333ab230d9b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 311
x-xss-protection: 1; mode=block
last-modified: Thu, 09 Dec 2021 14:54:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "4da97158326b0293b09b6a931c98a1e3"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Dec 2021 15:22:57 GMT

GET
H2 200 disqus-loader-17293b5282-rev.js Show response
www.zdnet.com/a/fly/js/components/ 1 KB
807 B 69ms
69ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/components/disqus-loader-17293b5282-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0aee86f10613d80ea0542d89047ea3467747db993379daeb592178ebf943b534

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 684
x-xss-protection: 1; mode=block
last-modified: Thu, 16 Dec 2021 16:41:54 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "0e5249bb6266844bc758597168d6931a"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Dec 2021 17:11:52 GMT

GET
H2 200 front-door-carousel-dcdcc78ebc-rev.js Show response
www.zdnet.com/a/fly/js/components/ 5 KB
2 KB 69ms
68ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 1651
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Dec 2021 16:02:01 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "aa0b07f3033f1a844f55155bbf0b9f8c"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Dec 2021 18:20:58 GMT

GET
H2 200 zdnet+9824ea10-5e49-4e4e-9202-a97915bb5fa4.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 315 KB
316 KB 236ms
62ms Image
image/jpeg 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9824ea10-5e49-4e4e-9202-a97915bb5fa4.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 6ea15d348d14879f357a86ee77c702c1f5c99db9bf8cd545b82b6e34f674b0a9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 34123
x-guploader-uploadid: ADPycdtAE2QrniskKvdpNzd5o6OYd5_SjZwfgiR9HbECJfK6TEjMi1uJhabaXViQdlbU44dp9JEDgo5Oz4Egx9OTzKfktyhK9Q
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 322717
x-served-by: cache-chi21173-CHI, cache-mxp6977-MXP
last-modified: Wed, 24 Feb 2021 17:44:06 GMT
server: UploadServer
x-timer: S1639721590.632327,VS0,VE1
etag: "00c554986f4ebaecd6b208182f2ab2c3"
x-goog-hash: crc32c=7ctnyQ==, md5=AMVUmG9OuuzWsggYLyqyww==
content-type: text/plain
cache-control: max-age=0, s-maxage=86400
accept-ranges: bytes
expires: Fri, 17 Dec 2021 20:25:52 GMT

GET
H2 200 zdnet+880e080a-7301-4a4b-a4e7-def615879cd5.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 5680ms
5507ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+880e080a-7301-4a4b-a4e7-def615879cd5.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: a6d814cd452c142099d23b1952b1f8f30a2f6c26b5c544a6d4c941ad387087bf

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
via: 1.1 varnish, 1.1 varnish
age: 669
x-guploader-uploadid: ADPycdsG5sOVadJ5WYGR7IJh8LG6gag8pHMot2X_ZxosGmOfshs_yDy1LYMTxS20H00BHo6G5ERCde4EA6hGASrvauiC7q_pUA
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 1333834
x-served-by: cache-chi21129-CHI, cache-mxp6977-MXP
last-modified: Thu, 12 Aug 2021 15:40:10 GMT
server: UploadServer
x-timer: S1639721590.633958,VS0,VE785
etag: "55fe6fa99fded7919ef98197501793e3"
x-goog-hash: crc32c=IPIV8Q==, md5=Vf5vqZ/e15Ge+YGXUBeT4w==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:02:02 GMT

GET
H2 200 zdnet+65e99cdf-bb9a-43e6-b9f2-7bbcfab2c195.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 377ms
203ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+65e99cdf-bb9a-43e6-b9f2-7bbcfab2c195.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 7a4c34b8b214e347836a070bad5395040344e037e289f77b11e9e49394ba0558

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 22
x-guploader-uploadid: ADPycdukNCqMV9mIdRKKmaawdMm87k6VwZpQfM_xgF2kkkWdSiYwInSD9IGKC8yV7g05AJyBSDuIs-S2E7JjFIgQ6mZAvLaBqg
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 1098648
x-served-by: cache-chi21161-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 15:33:22 GMT
server: UploadServer
x-timer: S1639721590.634025,VS0,VE111
etag: "6c5e7bec419989b25bd78586518ca3d4"
x-goog-hash: crc32c=PmX9Ug==, md5=bF577EGZibJb14WGUYyj1A==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 04:37:51 GMT

GET
H2 200 zdnet+9ace91bb-15e2-4b5f-90dc-a721785f2af9.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 3 MB
3 MB 408ms
235ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9ace91bb-15e2-4b5f-90dc-a721785f2af9.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: ee4fc478db1bf8c0b0746a3a07cef506a0b51d5db65d5b0aab3a1dbe1610dedd

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 425
x-guploader-uploadid: ADPycdv2oLJ5mqlruAcxyB1DD8WgzkYzzwqXk47x7EWqGeZVResDp3Q8Cp6m_BZuSsAPHD-nt_worEGj7pZlmyLc_PmRubfSbw
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 3334969
x-served-by: cache-chi21183-CHI, cache-mxp6977-MXP
last-modified: Tue, 21 Sep 2021 12:15:16 GMT
server: UploadServer
x-timer: S1639721590.634129,VS0,VE116
etag: "8cb626914b1b2008f701245e62b97271"
x-goog-hash: crc32c=AF6arw==, md5=jLYmkUsbIAj3ASReYrlycQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 05:33:33 GMT

GET
H2 200 zdnet+67d31788-4872-43ce-a4f9-31e95154f3fb.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 171 KB
171 KB 480ms
306ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+67d31788-4872-43ce-a4f9-31e95154f3fb.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 29996f1588a8aa881f5ed1a207b098a9a8cfead8a41f785d528ca3417ea52fc3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 0
x-guploader-uploadid: ADPycdsPmNjmVeoxdNwF3yxYVlKHs4t7J-G6ssPoQNT0i5IAuTVuZZvRlnf3BHg7ZDyidMSTEODH8wqxHEgZWVTjAlo
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 174929
x-served-by: cache-chi21178-CHI, cache-mxp6977-MXP
last-modified: Fri, 10 Dec 2021 14:03:19 GMT
server: UploadServer
x-timer: S1639721590.634095,VS0,VE147
etag: "c23bec11b723d1377e231e18cdfe53d3"
x-goog-hash: crc32c=qAvwoQ==, md5=wjvsEbcj0Td+Ix4Yzf5T0w==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 04:22:50 GMT

GET
H2 200 zdnet+40984316-75d4-4890-a717-84a4ec3a088a.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 1624ms
1451ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+40984316-75d4-4890-a717-84a4ec3a088a.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 753c21d87b2659d7ba709cf0b4b8824aeabe2405359821565daca11041b484bb

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 672
x-guploader-uploadid: ADPycdsHadYqN4Yqk98OcHKUnWENCj1ktooKeFHxboOaehOHPg43KEvTTvMySvpIGlr8Sc8nGUwULhsbDigOZO7jKusTZJEeTQ
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 1164965
x-served-by: cache-chi21178-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 19:58:18 GMT
server: UploadServer
x-timer: S1639721590.634177,VS0,VE228
etag: "09b9e61e214d49899600a60821de1fd6"
x-goog-hash: crc32c=FMrjMQ==, md5=CbnmHiFNSYmWAKYIId4f1g==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:01:58 GMT

GET
H2 200 zdnet+ed6b06a8-ae34-44b7-8700-b414434c2c8f.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 580 KB
580 KB 228ms
228ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+ed6b06a8-ae34-44b7-8700-b414434c2c8f.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 8ec9903b7dde91f7df4e256ecf77954228889888eb116a8843bea4d090a53a0c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 652
x-guploader-uploadid: ADPycduWjYaKlRlb5ptvdodI_yhF0mN1c1CkAXTNgzYuZH9hiUtJhSa6U5NMMS5pblgT7EwkX2FYwzG9wFLGJSYeyvJh1wgTHw
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 593747
x-served-by: cache-chi21137-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 22:08:15 GMT
server: UploadServer
x-timer: S1639721590.639011,VS0,VE110
etag: "61fcb1edc59954a28fc2e14cf6d715cd"
x-goog-hash: crc32c=iVnpeQ==, md5=Yfyx7cWZVKKPwuFM9tcVzQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 05:46:49 GMT

GET
H2 200 zdnet+9d722c2f-a001-4a65-beb1-9f292209da11.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 2 MB
2 MB 229ms
229ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9d722c2f-a001-4a65-beb1-9f292209da11.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: b8960dd4b158cad2e4e7b8317f26b7d36c528fa7301adaed4968d77dca548530

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 845
x-guploader-uploadid: ADPycduV722MolJMwLr0pZvXPl_igyenBT1wSrOFbxeitF5aPJzt42YhgxA4mlpD9BsY9apFna9iFShIcI1sxZVo15SEfY17iw
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 1643499
x-served-by: cache-chi21169-CHI, cache-mxp6977-MXP
last-modified: Sat, 04 Dec 2021 01:03:20 GMT
server: UploadServer
x-timer: S1639721590.639076,VS0,VE112
etag: "04117e42706c353e6644c8238c5fcd55"
x-goog-hash: crc32c=HURRCQ==, md5=BBF+QnBsNT5mRMgjjF/NVQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 05:43:50 GMT

GET
H2 200 zdnet+7da68c3c-ce8c-4754-bfe3-ad5a3957a1ca.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 954 KB
955 KB 249ms
249ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+7da68c3c-ce8c-4754-bfe3-ad5a3957a1ca.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 2f895ea849b9abb8aa3e6541b7e94e6ac460e643d50aa9c709f877a0a0a3e465

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 551
x-guploader-uploadid: ADPycdtUWAukKAV4OUsZ6Jof6_JDkW5bIpc-o_Mb4zoqayysZEW2Uh1PtcIJcA-1R0ZEr9pNLCwzgu6nB5RJThO5YIC_Nzt9YA
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 977315
x-served-by: cache-chi21145-CHI, cache-mxp6977-MXP
last-modified: Tue, 07 Dec 2021 19:38:14 GMT
server: UploadServer
x-timer: S1639721590.653438,VS0,VE111
etag: "1d1e2be75d6b59622adadb6f7487d874"
x-goog-hash: crc32c=46cmLA==, md5=HR4r511rWWIq2ttvdIfYdA==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 05:47:50 GMT

GET
H3 200 container.html Show response
b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B0E2 6 KB
3 KB 93ms
41ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 17 Dec 2021 06:13:09 GMT
expires: Sat, 17 Dec 2022 06:13:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 core-web-vitals-16efe3ae21-rev.js Show response
www.zdnet.com/a/fly/js/managers/ 545 B
456 B 73ms
73ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/managers/core-web-vitals-16efe3ae21-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

82f947d14a0a198dfe3cec2fde7896f6e332eb798cc193dad8da9ed2225277cd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 366
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Dec 2021 16:02:01 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "456e04f37a1b5aa7af3e4f05d7a26227"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Dec 2021 18:20:57 GMT

GET
H/1.1 200
OK NRBR-a22c617a7b2aab2da1c Show response
bam-cell.nr-data.net/1/ 49 B
725 B 197ms
131ms Script
text/javascript 162.247.243.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=2622&ck=1&ref=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/&ap=172&be=1067&fe=2506&dc=1207&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1639721586891,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:58,%22c%22:58,%22s%22:81,%22ce%22:186,%22rq%22:186,%22rp%22:1045,%22rpe%22:1124,%22dl%22:1047,%22di%22:1207,%22ds%22:1207,%22de%22:1207,%22dc%22:2506,%22l%22:2506,%22le%22:2516%7D,%22navigation%22:%7B%7D%7D&fp=1216&fcp=1216&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 17 Dec 2021 06:13:09 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 6bee00fef9678879-LHR

GET
H2 200 show-hide-1.0-2b8cfc35ab-rev.js Show response
www.zdnet.com/a/fly/js/components/ 2 KB
778 B 62ms
62ms Script
application/javascript 2a04:4e42:4c::666
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/a/fly/js/components/show-hide-1.0-2b8cfc35ab-rev.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1a703d617fb31d56238372d5bf78e9861b3a09b7447a0184bd5f1c178461ed12

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept
content-length: 710
x-xss-protection: 1; mode=block
last-modified: Thu, 09 Dec 2021 14:54:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "dd7ef257baebb2315958ebdd4603472f"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 varnish
cache-control: max-age=604800,no-transform
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Dec 2021 15:22:57 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 1371ms
1278ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame B0E2 22 KB
7 KB 120ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:05:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54463
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 16 Dec 2022 15:05:26 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame B0E2 4 KB
1 KB 140ms
49ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&lang=en

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 04:35:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 17 Dec 2021 06:13:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H3

200

B26699365.318190475;dc_pre=CM_1iveW6vQCFcqF_QcdONoGBg;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/ Frame B0E2
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatme...
https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_pre=CM_1iveW6vQCFcqF_QcdONoGBg;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rd...

42 B
63 B

157ms
107ms

Image
image/gif

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_pre=CM_1iveW6vQCFcqF_QcdONoGBg;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699365.318190475;dc_pre=CM_1iveW6vQCFcqF_QcdONoGBg;dc_trk_aid=510948085;dc_trk_cid=160229996;ord=1458941045;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 14375432174040730625
tpc.googlesyndication.com/simgad/ Frame B0E2 943 KB
944 KB 124ms
45ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14375432174040730625?

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06410b668985b047b6aa1c11723151eb469ec1e2d19f5134f843bcbbba2876ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 12 Dec 2021 08:59:22 GMT
x-content-type-options: nosniff
age: 422027
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 965887
x-xss-protection: 0
last-modified: Wed, 10 Nov 2021 17:05:01 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 12 Dec 2022 08:59:22 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B0E2 119 KB
37 KB 178ms
86ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/redventuresgamdisplay60805146916/ Frame B0E2 335 KB
112 KB 41ms
40ms Script
application/x-javascript 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 16:36:30 GMT
server: AmazonS3
x-amz-request-id: NS6M2NTW7BXQ838G
etag: "9c75e5b0c5bc0a53e0cdef53eae89c77"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=32896
accept-ranges: bytes
content-length: 114446
x-amz-id-2: mZU4c6FcEO3xZej083Xc3ltokyRr8g3vHMiVBhatMqfxxk7opyE6EWDDnqaU760ygCaBJqaPUCM=

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 957C 0
0 78ms
78ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssBsv1PkNkjow_lY_UKGZNsNnGuUwbCweUQfa2Q3QVRRjZapa0jfu4kirB3XbbRqm4xHhVE9xtvtecgJtVAL-LR_aKk9tWz8fs7-ElNTo82CNq1PSmWsBAvN1BG_XG86acZi_u4VqPrKo5BI_vyBstzOh4Yl692gIfoErOwf50Ac1y5h4f93UDTBh692Ih-gXvN4m-2gsnMZTdUkId5bdtKEP6QnvqsVGCFHps-fAOwnPhQn3TGBD-kVwQfclEWJ3JUEBLqaHh2u7IzVBkOSHactSOpHfPnKDvPkoFqor8tlFCuxtaBhQ_dOmdKyZRp0EcEOPcTxQ1dVc6hesB1_Qtg&sai=AMfl-YQC9AucqywO34IWklMJ9id_XHizLpaPBXLBJf42x8bsc0HoPHEuCXrjjvqn0DYj6gxjk-ZEdLm37W796ZyFM5yF1VlXRb01IswGBV0qUmEB8GXeUPMqft7hglRU-tw&sig=Cg0ArKJSzGt8pGGUTRLlEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 ad.js Show response
clipcentric-a.akamaihd.net/ad/B=608/F=1317278/C=603283/P=22/L=21/V=23/ST=1638969311/S=SzkmXuC3/ Frame 957C 162 KB
44 KB 320ms
104ms Script
text/javascript 2.16.107.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://clipcentric-a.akamaihd.net/ad/B=608/F=1317278/C=603283/P=22/L=21/V=23/ST=1638969311/S=SzkmXuC3/ad.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-16-107-33.deploy.static.akamaitechnologies.com

Software

Apache/2.2.34 /

Resource Hash

a65474aec3d05036fdc95a4459d85f1543f464934698df8e4a9d1bca61a0500c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: br
last-modified: Thu Jan 1 00:00:00 1970
server: Apache/2.2.34
x-frame-options: SAMEORIGIN
content-type: text/javascript
cache-control: max-age=3600
content-length: 44769

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/903347/59128492/ Frame 957C 46 KB
12 KB 197ms
54ms Script
application/javascript 54.229.132.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/903347/59128492/skeleton.js?ias_dspID=64
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.132.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-132-88.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 101c8b27f9bc4ef3e35779cdcc6cdf636fd4db74bca24fcb2ba1317c6baf151a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 957C 119 KB
37 KB 120ms
53ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/redventuresgamdisplay60805146916/ Frame 957C 335 KB
112 KB 47ms
47ms Script
application/x-javascript 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 16:36:30 GMT
server: AmazonS3
x-amz-request-id: NS6M2NTW7BXQ838G
etag: "9c75e5b0c5bc0a53e0cdef53eae89c77"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=32896
accept-ranges: bytes
content-length: 114446
x-amz-id-2: mZU4c6FcEO3xZej083Xc3ltokyRr8g3vHMiVBhatMqfxxk7opyE6EWDDnqaU760ygCaBJqaPUCM=

GET
H3

200

B26977839.322921542;dc_pre=COzMi_eW6vQCFVeS_QcdFIMCWw;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/ Frame 957C
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatme...
https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_pre=COzMi_eW6vQCFVeS_QcdFIMCWw;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rd...

42 B
63 B

141ms
102ms

Image
image/gif

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_pre=COzMi_eW6vQCFVeS_QcdFIMCWw;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N418801.3776911CBSINTERACTIVE.CO/B26977839.322921542;dc_pre=COzMi_eW6vQCFVeS_QcdFIMCWw;dc_trk_aid=515145515;dc_trk_cid=163324422;ord=1895546652;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B0E2 0
0 91ms
89ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrmnFVD6AOyTfCd5O8e0vDJ6LA4b-C_7fxeDSgUkW5yUvb4KYXoKBVonLSru6YdZbRZelQfNqWNnkVmMe4jaeH4H5D3cqF1hZn6HHltkr1kX6eCM-ssVlxrH-jD_ZTdE2Rq7TXx0il8RrYG5CBmXtMhwCdW_TuYCAVt0K1slBrt2byJMzq2V_yBtCsZ-ru2oxmrsb6drJU3b2tKFSGYmsGll2YZVz1vp1ETvNehlBlUtesF9n4mhvwLIyDtsuc6oaIw4zYophyISlEOtztQrm1DS5AEnLu5zchVFA_IWZuj0vDtsxNciSuvKTPH7c-Of0hB_uLy2e8MIJg-qq2y6cJ&sai=AMfl-YRf28Xwac2iP8wZxRz7lmjFqSjpCZuhKsDX0RWvNwyt2HszmErx-iaqYohIJs0EWI99F5I4X9T0bLppA3Fqd2eDv-WKEOlXs5GkYwjX3M19xRNz3zFkYmcLrV8s0sZj&sig=Cg0ArKJSzBXY2IOfFfI3EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame B0E2 15 KB
16 KB 180ms
91ms Font
font/woff2 2a00:1450:400e:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 10 Dec 2021 23:03:53 GMT
x-content-type-options: nosniff
age: 544156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 10 Dec 2022 23:03:53 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame B0E2 15 KB
16 KB 263ms
175ms Font
font/woff2 2a00:1450:400e:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 00:03:37 GMT
x-content-type-options: nosniff
age: 281372
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 14 Dec 2022 00:03:37 GMT

GET
H3 200 container.html Show response
b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BA09 6 KB
3 KB 57ms
57ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 17 Dec 2021 06:13:09 GMT
expires: Sat, 17 Dec 2022 06:13:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 957C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9477b3d4cdd340041acf6104e04d49bb5d7a8c0bc08418f3f4c8f53f59948eab

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 132ms
82ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639721589820&de=323435141851&m=0&ar=cc97a930ec1-clean&iw=101177c&q=6&cb=0&ym=0&cu=1639721589820&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1216%3A1216%3A2516%3A1207&iq=waiting&tt=waiting&tu=waiting&tp=waiting&jk=-1&jm=-1&fs=195926&na=2117720890&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
DATA 200
OK truncated
/ Frame B0E2 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51d1fd2811538c38ef16dfaaeb4c7a4c3aaa71c30fba2bc6d3db6b0f5281924b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 n.js Show response
geo.moatads.com/ Frame B0E2 112 B
286 B 87ms
87ms Script
text/html 52.31.222.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-Z%2Bh7GydOacklaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-4MFnRoeeeVpMDA%3D%3D&sc=1&os=1-IA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=126&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&m=0&ar=cc97a930ec1-clean&iw=101177c&q=2&cb=0&ym=0&cu=1639721589848&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A184%3A293%3A0%3A0&iq=waiting&tt=waiting&tu=waiting&tp=waiting&jk=-1&jm=-1&fs=195926&na=118114166&cs=0&ord=1639721589848&jv=980241350&callback=DOMlessLLDcallback_57342666
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.222.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-222-185.eu-west-1.compute.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: 329b801c09d8ddfe46296c0563753bffeb637b0f1c09146672adbbcec8f4a7c9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "08c73cc895eac6abb4cce9f267e78ef9dc51bef3"
content-length: 112
content-type: text/html; charset=UTF-8

GET
H2 200 n.js Show response
geo.moatads.com/ Frame B0E2 112 B
286 B 85ms
85ms Script
text/html 52.31.222.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-Z%2Bh7GydOacklaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-4MFnRoeeeVpMDA%3D%3D&sc=1&os=1-IA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=126&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&m=0&ar=cc97a930ec1-clean&iw=101177c&q=3&cb=0&ym=0&cu=1639721589848&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A184%3A293%3A0%3A0&iq=waiting&tt=waiting&tu=waiting&tp=waiting&jk=-1&jm=-1&fs=195926&na=1494819637&cs=0&callback=MoatDataJsonpRequest_57342666
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.222.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-222-185.eu-west-1.compute.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: 6f465f0d10ac14f650fde648357c60f9f7c1233c267a136208c4f3f0d35c205d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "64de48eeb7a70413feac89068331d659e07a23c1"
content-length: 112
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame B0E2 43 B
260 B 77ms
77ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&m=0&ar=cc97a930ec1-clean&iw=101177c&q=4&cb=0&ym=0&cu=1639721589848&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A184%3A293%3A0%3A0&iq=waiting&tt=waiting&tu=waiting&tp=waiting&jk=-1&jm=-1&fs=195926&na=954582317&cs=0
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:09 GMT

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 113ms
113ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 200 t
ingest.make.rvapps.io/v2/ Frame 0
0 116ms
115ms Preflight 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 900
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 zdnet+9824ea10-5e49-4e4e-9202-a97915bb5fa4.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 315 KB
316 KB 5043ms
5043ms Image
image/jpeg 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9824ea10-5e49-4e4e-9202-a97915bb5fa4.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 6ea15d348d14879f357a86ee77c702c1f5c99db9bf8cd545b82b6e34f674b0a9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:09 GMT
via: 1.1 varnish, 1.1 varnish
age: 34123
x-guploader-uploadid: ADPycdtAE2QrniskKvdpNzd5o6OYd5_SjZwfgiR9HbECJfK6TEjMi1uJhabaXViQdlbU44dp9JEDgo5Oz4Egx9OTzKfktyhK9Q
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 2
content-length: 322717
x-served-by: cache-chi21173-CHI, cache-mxp6977-MXP
last-modified: Wed, 24 Feb 2021 17:44:06 GMT
server: UploadServer
x-timer: S1639721590.934431,VS0,VE0
etag: "00c554986f4ebaecd6b208182f2ab2c3"
x-goog-hash: crc32c=7ctnyQ==, md5=AMVUmG9OuuzWsggYLyqyww==
content-type: text/plain
cache-control: max-age=0, s-maxage=86400
accept-ranges: bytes
expires: Fri, 17 Dec 2021 20:25:52 GMT

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 173ms
173ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 54ea2549eb776617398f110088f6752c767f249f7ec543d34353d3b390ccf634

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:10 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

POST
H2 200 t Show response
ingest.make.rvapps.io/v2/ 138 B
271 B 128ms
128ms XHR
application/json 184.72.183.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ingest.make.rvapps.io/v2/t
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-72-183-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6c8875aacffbc34e495e1603faaaeb505ce6acbc77f1d17934ff78bae4544367

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
Authorization: Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg==
Content-Type: application/json;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Dec 2021 06:13:10 GMT
access-control-allow-credentials: true
content-length: 138
vary: Origin
content-type: application/json

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 957C 0
0 86ms
86ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu1l0bLXIZsQ4wYcTfOQJRYX54JaNflXtc3G23qpp3gLIPgrn0g6dURoIOWkw3ybvEwdNsdsBQT-7MWIXUZWtGelj5QQ4Fh1pJeG5h1GeGgjxOMwDH9q861RvfcYwslD53vPnRcnKPy3P0jNhHN4eP_W6oarsbsmI-5KHHu-rrIEyP0kz7MSg0NKx9NLyqy0ui3esIcF2Mg9iEy8Rbxc3pu88F1WCcYH2GoNBYniC3UZQl882ccbE1C9Rnc2dFAnmXNNyAY6QBszCB72CgeYYqS1NHYcFVzUQ3fvPBA7t9uX1Vw1Yamg-vn-GeTgXwjKMBmjhUviRYRFwSbDCiWUU1cdOo&sai=AMfl-YRnWRxVBnPAmS8GBqQchIlOssQPWaGrdxcX4hXHIYXGc3HB1XOatQVPKAL4NjgUm-mkyHV8YIzuRJW-S5uemKxN77q33FCdU65eAFwSfNfhOuzdciVGVBvX9BX3wRU&sig=Cg0ArKJSzBY8G30GcXVdEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 main.gr.19.8.273.js Show response
static.adsafeprotected.com/ Frame 957C 187 KB
60 KB 242ms
66ms Script
application/javascript 2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.273.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/903347/59128492/skeleton.js?ias_dspID=64
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 00b3b0b438a1a3e7f01112f487ffb01e64db47935eb0e1e2927bdb4811ee935f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 10 Dec 2021 17:46:17 GMT
content-encoding: gzip
age: 563214
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 10 Dec 2021 17:31:00 GMT
server: AmazonS3
etag: W/"dbbed9b42f871ade260381ef78b0cd71"
vary: Accept-Encoding
x-amz-version-id: RbTKyuj_rScIKJ79M7NB4z2hCQfzt2bN
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
content-type: application/javascript
x-amz-cf-id: T9flt6_mGrZw2QRUByP_Uu6ZGc8yTJz68_7NVs5GomdyA52t3VKqug==

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B0E2 0
0 82ms
82ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv4K4mHtV2NMb2mJAu0cD1z0kjJkC7TzYUMYDbXarzwJ2OQeI3yTgOViP6ROWcY3HqlDGP2gL7AwQ5uz1ia0YUxECbVXbJGjKpOMnAvADTt-513KKRlFj69S4p-MuEekCJc5DstsiPdqZszDs3TRFemSWQTcAvlJtPNe3mIBsqsYliex9E211ei5zzeTvdDoMts-xMmb1TXbg8ug4mn9V_Iiu2bDMHd1knMDnkpuKY2dVAWm-GKD1gnZHd-0vTnSkkBCrxbm_GdOntpzs9mAxMd0cSeSg1YaWoKF5akZu0ma6YbrKPfIZeJ6TxGjlixrnTwt_zSNewH3Qmh3jekRAVnxhg&sai=AMfl-YToJz82eymVbnjeRJeUzM97yQxy1LFRyKE_ELMe5PXLnMu9PypPu7A_R6ioqzWLtXyAT9eX3TxkI1pMc-Gro2Hk3-bUkay2QrEF_byeJVYfo44GSGzUlHvNWmP7DNSI&sig=Cg0ArKJSzKvKHqNchAsXEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Dec 2021 06:13:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 23A6 624 B
838 B 175ms
51ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMShnQIQjY6qAhjrsZu9ATAB&v=APEucNVgdi1efKyESWzOegLBYe1QlA0_EeelVuoFzArfsJdQZTmQqEbyfqHv7kz3iIGP2onDDFk3EI0fDl1sQhZ0ZC2EZwbbPAqor1WyFxoC6hoBVd47ByzP7w-cCPKdu5kh3BuV3B9xkl1Y1q1Pkckyi4tuNg53aw

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 17 Dec 2021 06:13:10 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BA09 12 KB
9 KB 201ms
77ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C8Y8Jq2WmOt7cWJNsCFugxLlZFhmWepheM6-inET0L7PyLosyGYmH8S6J7EfIvtd1wMsUF98tVDok5NfsjAW0D9Yu-8ji_TC4N_GwSnPHucCKfsORCaezDsM6Gt0uMStDPB6XU_dUgomYsUKgQl1zSk7hm_w&dbm_d=AKAmf-B4f6j9iz8B1zSzSEI18JKT5GMngApk2ICblOPj-WZFByfV5w80fBfP_txzO1jKOY1NK3fYyXlnJDcgtCo4HeaEtWVOtok2W8qjDQMcZICDvNnYoQXg2mtnlKIPQ8oaYdb_NUvTZ8novdPOyQbQSv3ICTmwPTf0WxTCfHjm3QWnC5mtQ5zvADCnY6o4UhfB23DKSVp892nheRlcgWmsP6ERQr0SQfET_yvsnTUsEj_CYAHjLeenxvVzaIpgMEpxFrwZg6vX_5UNMu3Uh5yxhpGbHCllJVLT7DADkqMPz-fRnL8FJ6jh5y-5KBNzPRb9Qf1sUmY6wKR37Xf8edGnGl-BgPcuWzKSezyYJoYMSZByFiXW1xN7il4Mq1L6AMkacZypiV0DvTMwVGugUOHNbCtj9l6c6-Ue0adx01_8uUxVqPINPrF5s2x6wwGaB8WGCQmm7jCy3qBJCbD1A5vWH87BLAFws03r1J5khhBJ3wzH5uoPpykO1hW_2OyQZhxMrlk3VLka4fthS9194T8RPNkp4MEEV5OITQ1UrFNy8EFM_Vq7oznA9103Ea9DhRjSim6kgFL6zN3FxRvXQ-a-091lC2W-urRJyjFaCFsWSuPYoFC9Tl9dhJVh6Z2iD8WgavWsxIH3jOC_FHJF9-raX3dl4kSKTiSONqACAP24Emkl_As86UCQQRV7PPfnw2vdsbh51Iams1okDLhN10BhskmEmY_rILcOzm8q_PXSd_6K_WWi4mTx7S4MRqtuQBuiKsHWdbdUlCsnp-KdRTbcUCRzJix_3Q6QhslTJhOc5V0KqvNI7cxDNuMM0cWDBNmtm0BkbHD_kiK2bS0qVzeJZv0dR0kAPl7oxaP9AhlnSqER6He1S8bbs1F0VYDeY8m1cDBIUs9U01xEL2Bt308idR4n4C-5sB4M22vYc-F76yEUuETZLYaIEjmAqAmraFqzU23s4sW1x1T1wiqmNxdKlpNHhaydj9s2rWuh3vDDUiav1bcRhQrD70XkTGKeyYH61ze5DckBHD8d2I-WrHIH1p1nqyhU-BzWywlQNVMK-HJlOqrJDZWoqzPHdtFL90crdNJyRjtk3FK-h9aMUGYENEm4rLPTrK5LZLuNRmMdktIfEPcKBqrXnz-z5k4HNDHzAP5VhlgRf6Pm7Y1xd90pveXkDAux5HHYLhpJLUP-jkfBvu_5ms5FH147DoySrGEvIWgxnjDnaWej5IrWF4bQkA5AXnbsOERr2E8ZO10s9zNozVgdBkpqZo11UXrSwxb4kkoT5uIuq-RIBfwlFm3n2AzCLHRqvfiCB6FwsvOB8TLN18JGNQj0VBHRDoLSenACTNMaHHYtJzx73DxyTc7PO32WD7OeREAzCTRb7EpQjcs5jB0eo8XA044Ma45uZYycwvmH4wsRwPiqg_4ZVt8_MdcQlQKxVzBvtz9zqWydlgmbizlHf8wqlJQEKxu-E2cG0TyqXBqoPLaKBJJYy9o9k5a8pF4UYmdKArPCkFJJfb2PesDAR4CsKBhbAFdGWw0pIanUPmJUMqsJTiPSUHM4GPW384fiv9ft1w43reMITTwXn-9VbIXWQjciPr67RVjAWWuFmTdkUEEBseVGp3EJDn0210tg9Vg6hat6SujOwHNHR7Vlpn3RWrE9p5t7H5pXHPEJ7tYwB75QG4rfB3DvcHQuSRUo3xo0HmSP3BUu-GPVL1aIsVu87NC5wLTeqFTMhbOWhOJYV0JwjYqadUlJnzWqZwGlolRrfVw0qGjGpOLyLYLqmci75aeRYYxRh4Fu37M6lBJm1b9XzRekSN-1Bgud85cgaUXlEWZHatV-zsmtdCctYFl2rc-5xKicP_lepnqQ6jgLd4MGSiOancrzg2WIVzZQLigybZ4kXw4V5jjBSGgvOwj6lmCp8lgT3SNmi5phhL1U24Hh31JwFmmwkq1ugcMTM2CX_FMbll7z6RgKxP3iY-y06ieA8yeUK9a738vta8TLD8GSC_ci4o1CBbYoKtvZaIw6_hPJ2V2n95_TSTrJTq3YijfBqOSir6c6JmIa2fJKnwvSmeTho-fC_c7aB8qgfk9Q5OsIv4Z2GwScwVHaxtrdc8HxucDdWI3qfmT-i34s1UhHuZCALLoWt7qfMGBn4QcGXtF5XQNZPf2y-TWYKXIMScI2aP9reSTzraSqQCnK_ThM9ueQ6lx0ZqBk8_-8PRNmbOLcxWh1e6RcKJKYo_Tj4oa-tH_pLwMHkdblXw0tl7EtKwqqhB5wmegJiGPR1CZV0n2zK4X8tepzVsCJUQpEdlO9kLRyqBSnpw_5e7LNkPAJPbSELExpBiBwhF7IvBkgfTqsi9LJtuP10F7LaJITcAC_ybtC65qZq_HHlOFHRxsfVgKRnFEl65h4bGrlHM75dy9JLfdbBzRRlmnnK2-nogQM9Bzvd5TPlF7n8_wZ0Y4f-WIPnlBqftxNf8biWlk7WDy_Ym5TaUC7rE2A6iKm3QtXaf-sHjOs9rrKzO9tXquONLaTrsREjC5ra_bs6YPS0uWu8zjdsUH81QoCBJmmdnpn8cXRa63kP7yuopPluM0RE4EuntpZRBSl5kfDVlz8hNhwEdDyIwzVlZHpyYz5A5sA_prsLADLfi23V2Q-Q0HQ59HTW8wlV1MeXLr741HGRursbCNg83tBB1c6tcBPAo3m15FJYVf7ukbIp5m9c-piUjM7JXdoAn1CJMge73HaXrvZImwZc7kq6_1ukyiHkveq5ZALgUy8epaW1wgQBADT2yxeIZAzHTipnuGzdLC-wHQfn2vf_AvPG1D3WmB6hIHB3_sJQKL3u8ebK-69bqe0YEaQ-tHxZcqMENBRpGbXeocjYlitS34hABXp0NQnw1thaldiy6Ld8txjnVv3WLKujsbctUcTWrv35K3IewQQBOLY9F0j9-cFzQAHMmDoXTHiZPPoYUvhI-ts07BK_PppJV9azao1Fm_xT8p-sLGTvV7WpXiaa3t0UqcIGXejRXlCrxqcXnk9_0kzTLDhcny_KGT-m8ZMC-ZLfF42rDMGrIyEVu5_sZdqxxJmlDU3xuo2PTLZCtsHO3ejGEdnTsd0NZ-O3hgyD7P3gSGKHIadAcu1kW-ITXTdFxlNJNc2u6MT-5_Nkdnpr-9lMRbnALqa0RQmvrXS2KEe7OQCEmrlT0B1XNHCAvcDA_uUa3VnSnlOqqw_Qwf_Kl3EJAKPBEg5UMhYyaDlO7p-WnciDwNl-qv7wPuzmN6H4awyN7MPtknsU6CsC0RQlGrQjnpssH6Q8rbPqDlZxaLH9Vwi-SovIsRycJh6XB-8Od6S__1yGKWBfBmcS_k0kM4EAWTxnfkPTHJW2syqnIYf_X3Ev53mlg8lhM8dSGO7UnUaBPLP7xZU34nWM7kjDNv4_0dFVLpqjcTIigpGE6NIpnwg4rF79rsr_74rUaTw_OPIwVwCbqS4pmnaFpd-ha54HRkhB02UbCPSL-TTY2xnfJa5yCxqgGU-C-ASYqCj2sCuJx4PtvuYKts4hfq3lT5bSrShnOxnhaJWduZU7t-h7rCrArmqDkyQQDGxXA-fZI215Nk7DChuomuqU-5DaKrM737mjcdr_ZiPxjovPYmEDm4r1XL50XkN-XbC5_CFTxDhV4MNCGZlzlQu43bKUEc2oo6U39E3Vj5ihWz7GUK_eX9VG6dOKYOzQ6gSonF_2nfSk-LVFXOm3tV9L92mh9CHgpBPr0X33gylMJwfo3kpNLNMzIBIAztfO0avqTSfzQ_SyWIJbjsZl13i_Xtqxl5opd4Nf_RcOwPLSlfJlkeW93CteZy3u57f1C7_VTZ-7I4KyTBLPVAiie9ocBgYWfEo9wGp7Ud9B3jt6ObU7oUEMKcAXAOWzuUftTecErK5zhrEX9EIpTJIju1iyR4g45mRndX_quTInSet8kGBS-hSdC9ajR9rm1T18knUPPol7huOQfIs6lnGzwkMVBdu9h5-zNg09rw8wFVoRrW-tG7tCbEodmmpAUC9kDPH7B1h3dnXYgM6MdfxBrlT6Oaq1R0BkDAhGsc6lGQa53A0_JatIKWI5p7vCqZPWbmdWVZq4tpGCaWul_lycXvNZuvJfEp4Mm7Zjn6GKoqookQtwzk4w6ZaceQ4_cTnh4iL1bW152mDw3ile4Vgv8ptqSKKomOztV2OLpTPrSw5POC6-mCqgj-Z8-7DctveSmY7WG4hB-i0fa3SytwBo7_1dYnKniOQbwLA&cid=CAASFeRoCUsxFzhGuEd422kR5wmFm77iYg&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fsuspected-iranian-hackers-target-airline-with-new-backdoor%252F%240

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00a1bc7a279775f2c97e02482771589bdd002cb9bd23ed0bd8c051d2fdc6621e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8842
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA09 42 B
63 B 201ms
137ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CZugUWSdCmDDc6SP1t3MCMaVe2D9McF3v1z1kObbWEZRKuqHush3rVwF10WgRLHpcnNbcQrGuoS_V_ypBJNU3qSTbe6i8BLXmGNNT1AYsRBwr4uDM

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/902252/59081166/xbbe/creative/ Frame BA09 240 KB
74 KB 115ms
47ms Script
application/javascript 54.229.132.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/902252/59081166/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&ias_dspID=3&ias_campId=25634041&ias_pubId=pub-8820362605711196&ias_chanId=1&ias_placementId=15548172663&bidurl=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/&ias_dealId=1804173
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.132.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-132-88.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 9bc70475a78cf6d052b023d9a5f720b76e74eb6446236912ed2df2d429ccf8b7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame BA09 2 KB
1 KB 110ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:10:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 06:10:16 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BA09 119 KB
36 KB 218ms
155ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame BA09 15 KB
6 KB 110ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:03:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 607
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 06:03:03 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame BA09 0
0 155ms
45ms Image
text/html 2a00:1450:400e:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTfsl4KN59om9KWkwP5UZbBJt0gyH5NOobSaVn9Bl1bj_N7r0vGq4njwcpZbX9brrk461f1RzDD4oEw9PTMoRTF8w2pbw
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400e:80c::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1428 42 B
118 B 141ms
103ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZ2cLCtoIZCOsZ7nZiahaZ1aNYwR7mnltC-dZPAgHbcqmW3W0HOcAqokGql75NJ3uaQ4zSxd70ZF7VklR0dy3r4D2iEj9oSY29Djt-gQV19XFLTOI5W9pNaHwC8tqRyvKJ95nDXca7T6Zaa7WVkamRQoSx-Q&cry=1&dbm_d=AKAmf-AAFtLyjH1OZQKGsU5weJhskCwy6ls1s5XUBn-iXCLDvFdwmsaqc_XmBDWpXoKHvxcMY6FIOhMCjUFHUywjckYojBSG8CRvuZDMWFUcqW-763iwzW83phXKUflOWQDUNdFNyBWVpP56CjZShLn3M7uwk19I3RgIJ44gPFXNkPCsd9-KK8vFOYvhK_Kdq0rzg2vCKbxbRAtyaLB2WUnt_YKsv4xgSEal85WxzzHnDFh84_GgD64dypWzCJRdPyzb_hibvRpMrxrabfGk4cuoykGn70cVuaoqwVyRUMXTCVtRqRC2FiFZelXw7b5g6Pdl5ZN5Swb1uOjdrUi8c0gKEddFU7vMrMInqUVqyVwh3_P1l1R-JTGD5h9mI46Qli__m45XruhZOL0dpBzsU8A7ZpFGTiHrRWMaVdbeLF1E6LPsN65_BbNNG4OZtwYY2bxhStOzq4zy9D-6i50N0BrFTx4YxxeKc8nPDXVqNypsPTOnjXG2U-y4QGZCg6RP-sA6ZfisEt5EAAhK8Ku6Frh4hTj1B_vpHdXM_aJbt56S1C_MSJk0JPltw8xDlnypPV1VGPk54e7uZSjKbRlnNds1Fjrb_533tnnBH0J3q8Z4e3SwVE05_TSE-OfqYuENI-lHqJZv2Hav-2CS8xGo1oZpjlXVyvRt6F4RU7kQkWw_2q4gAH40gn2nx6-69jYwoliUWDViUyh1pOiKNl70f2TrcBbhSytVh0bzvp1AhklgnzIlCZhFPkre-7DvuCyU8YZgDgc__ttG2-hz9jhROCubOwAE3NJ0B_fK6fTPzqBOVYIT85fyWX-I4JfxZUocF3U7znfD9ZDrvDRDfQcu6YeGvfpFXyne71Ar2ZZelzh7V7VzBXJnptZWDFeiGhLMFo6vDl2sbHYrKxOEk1IHnpVKGcTWwzEhhEIYzSUILjSqoS2KyduqoQE9unr82nn5elRH80oQsVVuSWkD5F0pQ0UWRRZVh59_OzR54DKfL3S3huiNc3eDZlqDhqjZFULY0wk3ONWLxJAwrjQbe9AAnwZ-8YIG6gYO5Jux1fvL5QZobbZwObbh7IhcU86hiKPh_56s-OI4ODRASojGydhBczusZHDwTDdA2UPgxQfPcN7ZMZdV7QgDOfKFNJd7onaEjfvxblzgYgIn14uZ1yuKOUZOndw8SSQicmX22EpiQOg7bSS921xTupBOte_4pUYoYvRq4auvOK4ZDw9E6zFcP49VIyUaMuk3-S_SapCb7JrgDRTTJ9SXFcjYASe2Goqz9FPRaadgSfUA7XIFYMxCqL3GSWvYOzGWMwwOPFjdpOEhnBI4wzXSXt59PwqTVATphpOIZebF5nK9uaQsQSCil4x7bpgFSHXpkkSTGep2XvB4Bs2VD3Dv-iI4LSgbRVJDRSByIkCIZONkiI0kKwKZgLtFnGymBVAl9p5HXI1dkr7lQ6hEvptfYNoNdA_hdA4_0Km23Z3h4J99Vm0Zl2LAtUUjNUQpMCKjAadDzhn_RTnYX9t4Fnp9bna20iyyVbBb71JUqeZolSxj04mcTWV8Lej8NTl2C_ETrbeQy3r8vjoISnWt2tlQh8_RPl_cvZEmOhFS7_N-LeBfFaXZcj28oUSjSjb1TJJkUTI8zTyReSlCXadBMs03GV_zUTWreOoeDnoIyku1YheRYDpj6SEFw2_Cs7H97D8AKgxpv05QpF9a9ot4k0_EhfdzAvEAXUtCv0INNwFhY0Geih2AQiCfxBC0BKxiywM9-fCoS9vWxuyQDSNDHFHeopMkuIv-JFNdKRku233VsbnRgEMoOfNfz_shAa2EPYBloqHCY89zfCm2xT19WM9rDRMkIJX-THuMKSAwItOFUAGQf_Hs27QfNCPRnvFz4vKMgvTQPg4UJsFBYyaLPT3mHeC4dZLIQnGM5trPb7ktbx63jyIIC3oT8n2YIRoIHHDfalAVWLwx8PFQkNysscX1Y8rC8r8Fs6begC9eKUw-G3b-H-nL2yWirm_4ewMlo3A92TgBnTJPSgY8x6l69tbWzG5HT1lCxXCnWUsLtsqi7zmxWb-0Q7GhCduhz_enpLos3q4NYYSNeXNSbjoJlGzMuICVQtyVTL-N9bVX4K0QUachFVJbJbQaReNB32q1zbJRDyc_pDJJiwQqDKKGtHlciIMZRDzH2aK3gwlR9FsAV05WnwEal2aBmdjwtePTodYwG9m4NevqKKEJ2aU_z_BXqHBjju8YuTTJ2UykHEA4Yh6-qucXYPPM7ivB735oEVaxJNR3ox04JLOoUzwQ4V0TNRXbdxcibEsejqYubSQTd-7lZPMfXQ1tF_Tiuc4vX6wUnEIdQ7YjA8fyuBqgoLDJ4cTlihBTFFLPQIm8a9SkN9MYerx1qgzHlJFWyLDNxE9DrRFyIR8T5Q6lWmi_ghhy5Yp5P7sqLY3T8KX9rYQzZlQVQbb8qHX5kTYMeeurkssGR9jbwZlbw3m8hInfxK6ODdaIzL0HxWMAIi2c2gZQ4rLqSNPfncThMBGWTtPjA-45SwDjHxEmYTPaOTPUh17u0i18_89w9iTtz3AI8Gm9ByiLmqSZ3Bxy3002VIjylFt8P09jgsKeLsoMw2dxcz1XVhXzBiWrh214T1L6ZZn4yfp-whsURejc55yrKAk54D-Me2t1mVilK_U69ygg94z7vNUATlUUxoE75M4gsUXIgKeVI7XxNGaoU3-oLJC6sJklZr38w3JZn3wMcZOU44TiwEyzGTK3Z4sbksLKbKHeESZhr8anhgXz8dxFzBq4std0i8iEB2Kq185a8Ej_6XMY-e_KiNp8-Dk0IRiW0SANg7bsr8-CP_p0yT1Fa-vucTWJ3Wn5hiDi76RYD9bQ2WmoxJdkKlzqyEU6aAgQ2juiSzfUpa5vuz_jU0LZMYhZ72XBMUknZlSPVxDWzpJLgc5yZ3IDbc-yTGkpoz4qCzFZty1gMqjOOjIDC5oDZtdFUgPjZRAaqqwhiXBn_4ITpVacByVOTTsw_XXfJbIUo_sje4D1l9d1jLYk0ODmmIuNmcMtrUNAd7jqAjxDRAmdnwYDrXDgJf-nT4jRHDUVsgGDgPHnEak6wbI57-LTW8wbeIngQmchgLobQNMOILN0Nenx6yVzOyDxbb39GazT8j-lH9RBCQNaapyvYcKOVbWf8TmVNOCwS9mzod-8dcne4vic7-zDzO4zIeW6cEL1eYm-wxvWEAVCvew9c-AFLmEF58BOHgoOipooFFYY6ZyqrWWNPX6xb689y25B56zbXbYwKhvMujsC95KEszAzndv-8b-bN4lBvAEbkhL_npvYRU074fdLJ0zozSR6atm_8aWx8-GsUYij78H98wBrQxEDcSyhmHHnGsJC78D_RzIw6C7U2S2mZGQTT6gveEMzr8H3t4elDwGlEFdAPPKPNpFaFjvKVGUzneLKwIKeSULGjDjlrghmlmKnxw2eCXXkPvPtB6IvRW7wJ4xt4QWkTwH3yaQv673pwiyZDP9fzeElRgrJVn5TvYh6zrFoBZFz8czt24Tc6vaSN5kCcLhSNfiG5W9x8zc3odDxmoC6aBRQQJ2VjFOpbCXab9MLBJvnVZftsi9IdaP9jp-bezhD4Pa0kWUkSKnMvFlcQpMIORohu4bS0W2YQhc2Loa4aBzgXPvu7hTCGHqW9_iu8ZKDXHfwdB0LPje7H5dJEswe0XMId5E8BsjF_MvjB50n6nWCSugv4pQ0Q-0St_aI_yu_o-nKs0ePgoGG-xCTFKoqIFLjBi7tFYLaJTirw0A8kAyNgauXs7GMamRYjViuTPK1DyOfuSov66IqBP6IZJpBAvyv0MmTRawMfpJumln6q8k8qhPMb8oHYE3-qn0-uzK2s12-HJmYv706sEB2gNfsx_9VB4flajgYv_mGp_f3o4uVXXzhNOp236W45ogjHseY5wyLheopYep46pxICPiPZwZ5MRzglt0dLsBHNNsOL2d-lVhBiZqpuCcQTneZsoPXXgpT2GoKnCD535TSEzHkhB0SQk7QXsB_BWjv-CTumf4--0sUsDNdxHaRNSW-_whRI6nGdekpC1i7uOkfOKL4yvDY8bdlNFj8iBtcSZBrK9KcxgMjvyXU&cid=CAASFeRozEs15nMjOlPc-QEBivqj-VpTZg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 1428 9 KB
4 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:05:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4486
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:29:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 17 Dec 2021 07:05:27 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/886082/58856297/ Frame 1428 46 KB
13 KB 77ms
76ms Script
application/javascript 54.229.132.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/886082/58856297/skeleton.js?ias_dspID=64
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.132.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-132-88.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 71250efca09863ab52eec2177b9b59be4d722eb5b47505b26ef2eb5c31437df9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
x-server-name: app12.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1428 119 KB
36 KB 136ms
136ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/redventuresgamdisplay60805146916/ Frame 1428 335 KB
112 KB 38ms
38ms Script
application/x-javascript 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 16:36:30 GMT
server: AmazonS3
x-amz-request-id: NS6M2NTW7BXQ838G
etag: "9c75e5b0c5bc0a53e0cdef53eae89c77"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=32895
accept-ranges: bytes
content-length: 114446
x-amz-id-2: mZU4c6FcEO3xZej083Xc3ltokyRr8g3vHMiVBhatMqfxxk7opyE6EWDDnqaU760ygCaBJqaPUCM=

GET
DATA 200
OK truncated
/ Frame 772D 750 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9cac3eeba1fc86e06fdc013a4c52742e9b4bd14b7be6517321127d4515095ce

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 E=in,im,fi
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=36/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 427ms
128ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=36/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=in,im,fi

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 tavAo53F
clipcentric-a.akamaihd.net/file/1317301/ad_q60/1638969188/ Frame 957C 9 KB
9 KB 49ms
48ms Image
image/avif 2.16.107.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://clipcentric-a.akamaihd.net/file/1317301/ad_q60/1638969188/tavAo53F?f=auto

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-16-107-33.deploy.static.akamaitechnologies.com

Software

Apache/2.2.34 /

Resource Hash

80564ff963220266c89e284ae65634312da063d0ea5ee747527fd38e8c398d96

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Wed, 08 Dec 2021 13:14:16 GMT
server: Apache/2.2.34
x-frame-options: SAMEORIGIN
content-type: image/avif
access-control-allow-origin: *
cache-control: private, max-age=31536000
content-length: 9282

GET
H2 200 h1xcxKOE
clipcentric-a.akamaihd.net/file/1317303/ad_q60/1638969190/ Frame 957C 8 KB
8 KB 53ms
52ms Image
image/avif 2.16.107.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://clipcentric-a.akamaihd.net/file/1317303/ad_q60/1638969190/h1xcxKOE?f=auto

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-16-107-33.deploy.static.akamaitechnologies.com

Software

Apache/2.2.34 /

Resource Hash

43fdf898c76171d1b5af752978ebeb6ed248bc677d0b1dfb204b7ae95658cd99

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Wed, 08 Dec 2021 13:14:14 GMT
server: Apache/2.2.34
x-frame-options: SAMEORIGIN
content-type: image/avif
access-control-allow-origin: *
cache-control: private, max-age=31536000
content-length: 7924

GET
H2 200 E=ls:Clipcentric%20Site%20Fixes.0,li
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=40/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 427ms
128ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=40/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:Clipcentric%20Site%20Fixes.0,li

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame F300 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 E=ls:video%20auto.0
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=48/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 427ms
128ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=48/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:video%20auto.0

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=ls:Super%20Billboard.0
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=51/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
160 B 425ms
127ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=51/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:Super%20Billboard.0

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=ls:hotspots%20collapsed.0
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=63/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 427ms
129ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=63/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:hotspots%20collapsed.0

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=ls:on%20scroll%20full%20collapse.0
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=63/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 449ms
236ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=ls:custom%20ad%20controls.0
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=64/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 232ms
232ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=64/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:custom%20ad%20controls.0

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 ad.html Show response
clipcentric-a.akamaihd.net/user-9/resources/ Frame 69B3 93 B
290 B 45ms
45ms Document
text/html 2.16.107.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://clipcentric-a.akamaihd.net/user-9/resources/ad.html
Requested by: Host: clipcentric-a.akamaihd.net
URL: https://clipcentric-a.akamaihd.net/ad/B=608/F=1317278/C=603283/P=22/L=21/V=23/ST=1638969311/S=SzkmXuC3/ad.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-107-33.deploy.static.akamaitechnologies.com
Software: Apache/2.2.34 /
Resource Hash: e571945dec453fbc4c8177ad3af3f176dc562cf51fe40a10529b69e0b2b1e577

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

expires: Thu, 13 Jan 2022 13:55:46 GMT
last-modified: Tue, 04 May 2021 03:22:49 GMT
etag: "5d-5c17897b4d440"
cache-control: max-age=2592000
server: Apache/2.2.34
content-type: text/html; charset=UTF-8
accept-ranges: bytes
content-encoding: gzip
content-length: 86
date: Fri, 17 Dec 2021 06:13:10 GMT
vary: Accept-Encoding

GET
H2 200 zdnet+67d31788-4872-43ce-a4f9-31e95154f3fb.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 171 KB
171 KB 5762ms
5762ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+67d31788-4872-43ce-a4f9-31e95154f3fb.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 29996f1588a8aa881f5ed1a207b098a9a8cfead8a41f785d528ca3417ea52fc3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
via: 1.1 varnish, 1.1 varnish
age: 0
x-guploader-uploadid: ADPycdvxrVUNnIhDq46p3rFeGcOKoW3QodsfSsZB0jGnBU5o9Zu03McMcW6wsFpXqcFKDx91BP_phlrrVO8nR8Lempc
x-cache: MISS, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 0, 0
content-length: 174929
x-served-by: cache-chi21121-CHI, cache-mxp6977-MXP
last-modified: Fri, 10 Dec 2021 14:03:19 GMT
server: UploadServer
x-timer: S1639721590.185899,VS0,VE341
etag: "c23bec11b723d1377e231e18cdfe53d3"
x-goog-hash: crc32c=qAvwoQ==, md5=wjvsEbcj0Td+Ix4Yzf5T0w==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
DATA 200
OK truncated
/ Frame F300 299 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95698b6af45a720fa13415398e77c20504c6ae8bf75e3a462e5aa1f67bc42b11

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 206 video.high.mp4
clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/ Frame 957C 1 MB
1 MB 52ms
52ms Media
video/mp4 2.16.107.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.107.33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-16-107-33.deploy.static.akamaitechnologies.com

Software

Apache/2.2.34 /

Resource Hash

2ea6cb8d44b18ddc26d8d83cbb898b780beeebe9d7529fceb1ac1824a397cff4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Range: bytes=0-

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Wed, 08 Dec 2021 12:33:46 GMT
server: Apache/2.2.34
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
content-type: video/mp4
Content-Range: bytes 0-1199289/1199290
cache-control: max-age=2592000
Content-Length: 1199290

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=124/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vimpressi... Frame 957C 35 B
159 B 232ms
232ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=124/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vimpression:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=vi
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=124/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 233ms
233ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=124/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vi

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 zdnet+65e99cdf-bb9a-43e6-b9f2-7bbcfab2c195.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 5829ms
5829ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+65e99cdf-bb9a-43e6-b9f2-7bbcfab2c195.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 7a4c34b8b214e347836a070bad5395040344e037e289f77b11e9e49394ba0558

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
via: 1.1 varnish, 1.1 varnish
age: 23
x-guploader-uploadid: ADPycdtAjMw3y2TaNNQgBpZEPDDBbi7KSPDmGet9U4pOjzA_ClVYMY1RX0HjD-4lzu8OHfUtVlpFtRETGcoIY7lRTyQMEHYT0A
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 1098648
x-served-by: cache-chi21126-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 15:33:22 GMT
server: UploadServer
x-timer: S1639721590.207824,VS0,VE404
etag: "6c5e7bec419989b25bd78586518ca3d4"
x-goog-hash: crc32c=PmX9Ug==, md5=bF577EGZibJb14WGUYyj1A==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:12:47 GMT

GET
H3 200 impl_v81.js Show response
www.googletagservices.com/dcm/ Frame 1428 41 KB
17 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v81.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:05:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17189
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:28:15 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 15:05:27 GMT

GET
H2 200 store.phtml Show response
ad.clipcentric.com/user-9/resources/ Frame E33E 3 KB
3 KB 165ms
62ms Document
text/html 65.9.64.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.clipcentric.com/user-9/resources/store.phtml?v200530
Requested by: Host: clipcentric-a.akamaihd.net
URL: https://clipcentric-a.akamaihd.net/ad/B=608/F=1317278/C=603283/P=22/L=21/V=23/ST=1638969311/S=SzkmXuC3/ad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.64.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-64-94.fra56.r.cloudfront.net
Software: Apache/2.2.34 /
Resource Hash: 81bcd7a6372e5ca7f7d12382fe1787bd4635eede42b3a79da6937c6d2354ed8b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

content-type: text/html; charset=UTF-8
content-length: 2965
date: Mon, 26 Jul 2021 00:31:36 GMT
server: Apache/2.2.34
access-control-allow-origin: *
cache-control: max-age=31536000
x-cache: Hit from cloudfront
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 93sAzccIYHcPvnRYUzJMGZSTK6hamU1rO8RerlvIWjRE-ddrVTl9Hg==
age: 12462094

GET
DATA 200
OK truncated
/ Frame F300 500 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b4f05cfd0cd8e216e445b5aec5e9f06573c18cb7adbc0cd785f3a4af3df7cf2

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame F300 807 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ccd7a7e0ecd791d87287f7ebb4f4c3e6fcb0ca72996ee874fc2755b15fb187ef

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H/1.1 200
OK NRBR-a22c617a7b2aab2da1c Show response
bam-cell.nr-data.net/events/1/ 24 B
501 B 145ms
144ms XHR
image/gif 162.247.243.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=3303&ck=1&ref=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain

Response headers

Date: Fri, 17 Dec 2021 06:13:10 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 6bee0102c8598879-LHR
Content-Length: 24

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BA09 41 KB
15 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C8Y8Jq2WmOt7cWJNsCFugxLlZFhmWepheM6-inET0L7PyLosyGYmH8S6J7EfIvtd1wMsUF98tVDok5NfsjAW0D9Yu-8ji_TC4N_GwSnPHucCKfsORCaezDsM6Gt0uMStDPB6XU_dUgomYsUKgQl1zSk7hm_w&dbm_d=AKAmf-B4f6j9iz8B1zSzSEI18JKT5GMngApk2ICblOPj-WZFByfV5w80fBfP_txzO1jKOY1NK3fYyXlnJDcgtCo4HeaEtWVOtok2W8qjDQMcZICDvNnYoQXg2mtnlKIPQ8oaYdb_NUvTZ8novdPOyQbQSv3ICTmwPTf0WxTCfHjm3QWnC5mtQ5zvADCnY6o4UhfB23DKSVp892nheRlcgWmsP6ERQr0SQfET_yvsnTUsEj_CYAHjLeenxvVzaIpgMEpxFrwZg6vX_5UNMu3Uh5yxhpGbHCllJVLT7DADkqMPz-fRnL8FJ6jh5y-5KBNzPRb9Qf1sUmY6wKR37Xf8edGnGl-BgPcuWzKSezyYJoYMSZByFiXW1xN7il4Mq1L6AMkacZypiV0DvTMwVGugUOHNbCtj9l6c6-Ue0adx01_8uUxVqPINPrF5s2x6wwGaB8WGCQmm7jCy3qBJCbD1A5vWH87BLAFws03r1J5khhBJ3wzH5uoPpykO1hW_2OyQZhxMrlk3VLka4fthS9194T8RPNkp4MEEV5OITQ1UrFNy8EFM_Vq7oznA9103Ea9DhRjSim6kgFL6zN3FxRvXQ-a-091lC2W-urRJyjFaCFsWSuPYoFC9Tl9dhJVh6Z2iD8WgavWsxIH3jOC_FHJF9-raX3dl4kSKTiSONqACAP24Emkl_As86UCQQRV7PPfnw2vdsbh51Iams1okDLhN10BhskmEmY_rILcOzm8q_PXSd_6K_WWi4mTx7S4MRqtuQBuiKsHWdbdUlCsnp-KdRTbcUCRzJix_3Q6QhslTJhOc5V0KqvNI7cxDNuMM0cWDBNmtm0BkbHD_kiK2bS0qVzeJZv0dR0kAPl7oxaP9AhlnSqER6He1S8bbs1F0VYDeY8m1cDBIUs9U01xEL2Bt308idR4n4C-5sB4M22vYc-F76yEUuETZLYaIEjmAqAmraFqzU23s4sW1x1T1wiqmNxdKlpNHhaydj9s2rWuh3vDDUiav1bcRhQrD70XkTGKeyYH61ze5DckBHD8d2I-WrHIH1p1nqyhU-BzWywlQNVMK-HJlOqrJDZWoqzPHdtFL90crdNJyRjtk3FK-h9aMUGYENEm4rLPTrK5LZLuNRmMdktIfEPcKBqrXnz-z5k4HNDHzAP5VhlgRf6Pm7Y1xd90pveXkDAux5HHYLhpJLUP-jkfBvu_5ms5FH147DoySrGEvIWgxnjDnaWej5IrWF4bQkA5AXnbsOERr2E8ZO10s9zNozVgdBkpqZo11UXrSwxb4kkoT5uIuq-RIBfwlFm3n2AzCLHRqvfiCB6FwsvOB8TLN18JGNQj0VBHRDoLSenACTNMaHHYtJzx73DxyTc7PO32WD7OeREAzCTRb7EpQjcs5jB0eo8XA044Ma45uZYycwvmH4wsRwPiqg_4ZVt8_MdcQlQKxVzBvtz9zqWydlgmbizlHf8wqlJQEKxu-E2cG0TyqXBqoPLaKBJJYy9o9k5a8pF4UYmdKArPCkFJJfb2PesDAR4CsKBhbAFdGWw0pIanUPmJUMqsJTiPSUHM4GPW384fiv9ft1w43reMITTwXn-9VbIXWQjciPr67RVjAWWuFmTdkUEEBseVGp3EJDn0210tg9Vg6hat6SujOwHNHR7Vlpn3RWrE9p5t7H5pXHPEJ7tYwB75QG4rfB3DvcHQuSRUo3xo0HmSP3BUu-GPVL1aIsVu87NC5wLTeqFTMhbOWhOJYV0JwjYqadUlJnzWqZwGlolRrfVw0qGjGpOLyLYLqmci75aeRYYxRh4Fu37M6lBJm1b9XzRekSN-1Bgud85cgaUXlEWZHatV-zsmtdCctYFl2rc-5xKicP_lepnqQ6jgLd4MGSiOancrzg2WIVzZQLigybZ4kXw4V5jjBSGgvOwj6lmCp8lgT3SNmi5phhL1U24Hh31JwFmmwkq1ugcMTM2CX_FMbll7z6RgKxP3iY-y06ieA8yeUK9a738vta8TLD8GSC_ci4o1CBbYoKtvZaIw6_hPJ2V2n95_TSTrJTq3YijfBqOSir6c6JmIa2fJKnwvSmeTho-fC_c7aB8qgfk9Q5OsIv4Z2GwScwVHaxtrdc8HxucDdWI3qfmT-i34s1UhHuZCALLoWt7qfMGBn4QcGXtF5XQNZPf2y-TWYKXIMScI2aP9reSTzraSqQCnK_ThM9ueQ6lx0ZqBk8_-8PRNmbOLcxWh1e6RcKJKYo_Tj4oa-tH_pLwMHkdblXw0tl7EtKwqqhB5wmegJiGPR1CZV0n2zK4X8tepzVsCJUQpEdlO9kLRyqBSnpw_5e7LNkPAJPbSELExpBiBwhF7IvBkgfTqsi9LJtuP10F7LaJITcAC_ybtC65qZq_HHlOFHRxsfVgKRnFEl65h4bGrlHM75dy9JLfdbBzRRlmnnK2-nogQM9Bzvd5TPlF7n8_wZ0Y4f-WIPnlBqftxNf8biWlk7WDy_Ym5TaUC7rE2A6iKm3QtXaf-sHjOs9rrKzO9tXquONLaTrsREjC5ra_bs6YPS0uWu8zjdsUH81QoCBJmmdnpn8cXRa63kP7yuopPluM0RE4EuntpZRBSl5kfDVlz8hNhwEdDyIwzVlZHpyYz5A5sA_prsLADLfi23V2Q-Q0HQ59HTW8wlV1MeXLr741HGRursbCNg83tBB1c6tcBPAo3m15FJYVf7ukbIp5m9c-piUjM7JXdoAn1CJMge73HaXrvZImwZc7kq6_1ukyiHkveq5ZALgUy8epaW1wgQBADT2yxeIZAzHTipnuGzdLC-wHQfn2vf_AvPG1D3WmB6hIHB3_sJQKL3u8ebK-69bqe0YEaQ-tHxZcqMENBRpGbXeocjYlitS34hABXp0NQnw1thaldiy6Ld8txjnVv3WLKujsbctUcTWrv35K3IewQQBOLY9F0j9-cFzQAHMmDoXTHiZPPoYUvhI-ts07BK_PppJV9azao1Fm_xT8p-sLGTvV7WpXiaa3t0UqcIGXejRXlCrxqcXnk9_0kzTLDhcny_KGT-m8ZMC-ZLfF42rDMGrIyEVu5_sZdqxxJmlDU3xuo2PTLZCtsHO3ejGEdnTsd0NZ-O3hgyD7P3gSGKHIadAcu1kW-ITXTdFxlNJNc2u6MT-5_Nkdnpr-9lMRbnALqa0RQmvrXS2KEe7OQCEmrlT0B1XNHCAvcDA_uUa3VnSnlOqqw_Qwf_Kl3EJAKPBEg5UMhYyaDlO7p-WnciDwNl-qv7wPuzmN6H4awyN7MPtknsU6CsC0RQlGrQjnpssH6Q8rbPqDlZxaLH9Vwi-SovIsRycJh6XB-8Od6S__1yGKWBfBmcS_k0kM4EAWTxnfkPTHJW2syqnIYf_X3Ev53mlg8lhM8dSGO7UnUaBPLP7xZU34nWM7kjDNv4_0dFVLpqjcTIigpGE6NIpnwg4rF79rsr_74rUaTw_OPIwVwCbqS4pmnaFpd-ha54HRkhB02UbCPSL-TTY2xnfJa5yCxqgGU-C-ASYqCj2sCuJx4PtvuYKts4hfq3lT5bSrShnOxnhaJWduZU7t-h7rCrArmqDkyQQDGxXA-fZI215Nk7DChuomuqU-5DaKrM737mjcdr_ZiPxjovPYmEDm4r1XL50XkN-XbC5_CFTxDhV4MNCGZlzlQu43bKUEc2oo6U39E3Vj5ihWz7GUK_eX9VG6dOKYOzQ6gSonF_2nfSk-LVFXOm3tV9L92mh9CHgpBPr0X33gylMJwfo3kpNLNMzIBIAztfO0avqTSfzQ_SyWIJbjsZl13i_Xtqxl5opd4Nf_RcOwPLSlfJlkeW93CteZy3u57f1C7_VTZ-7I4KyTBLPVAiie9ocBgYWfEo9wGp7Ud9B3jt6ObU7oUEMKcAXAOWzuUftTecErK5zhrEX9EIpTJIju1iyR4g45mRndX_quTInSet8kGBS-hSdC9ajR9rm1T18knUPPol7huOQfIs6lnGzwkMVBdu9h5-zNg09rw8wFVoRrW-tG7tCbEodmmpAUC9kDPH7B1h3dnXYgM6MdfxBrlT6Oaq1R0BkDAhGsc6lGQa53A0_JatIKWI5p7vCqZPWbmdWVZq4tpGCaWul_lycXvNZuvJfEp4Mm7Zjn6GKoqookQtwzk4w6ZaceQ4_cTnh4iL1bW152mDw3ile4Vgv8ptqSKKomOztV2OLpTPrSw5POC6-mCqgj-Z8-7DctveSmY7WG4hB-i0fa3SytwBo7_1dYnKniOQbwLA&cid=CAASFeRoCUsxFzhGuEd422kR5wmFm77iYg&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fsuspected-iranian-hackers-target-airline-with-new-backdoor%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54462
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Dec 2022 15:05:28 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 23A6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1

43 B
892 B

59ms
56ms

Image
image/gif

92.123.125.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMShnQIQjY6qAhjrsZu9ATAB&v=APEucNVgdi1efKyESWzOegLBYe1QlA0_EeelVuoFzArfsJdQZTmQqEbyfqHv7kz3iIGP2onDDFk3EI0fDl1sQhZ0ZC2EZwbbPAqor1WyFxoC6hoBVd47ByzP7w-cCPKdu5kh3BuV3B9xkl1Y1q1Pkckyi4tuNg53aw
Protocol: HTTP/1.1
Server: 92.123.125.44 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 17 Dec 2021 06:13:10 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 23A6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbwqdlLjCgZe480XVyZzmgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1

43 B
892 B

62ms
62ms

Image
image/gif

92.123.125.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMShnQIQjY6qAhjrsZu9ATAB&v=APEucNVgdi1efKyESWzOegLBYe1QlA0_EeelVuoFzArfsJdQZTmQqEbyfqHv7kz3iIGP2onDDFk3EI0fDl1sQhZ0ZC2EZwbbPAqor1WyFxoC6hoBVd47ByzP7w-cCPKdu5kh3BuV3B9xkl1Y1q1Pkckyi4tuNg53aw
Protocol: HTTP/1.1
Server: 92.123.125.44 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 17 Dec 2021 06:13:10 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQVrl8xGM9_vw7Lz8A-SKU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 23A6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELS7I6e4--Pf2RH8Zd4uUJc&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELS7I6e4--Pf2RH8Zd4uUJc%26google_cver%3D1

43 B
1 KB

75ms
75ms

Image
image/gif

37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELS7I6e4--Pf2RH8Zd4uUJc%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMShnQIQjY6qAhjrsZu9ATAB&v=APEucNVgdi1efKyESWzOegLBYe1QlA0_EeelVuoFzArfsJdQZTmQqEbyfqHv7kz3iIGP2onDDFk3EI0fDl1sQhZ0ZC2EZwbbPAqor1WyFxoC6hoBVd47ByzP7w-cCPKdu5kh3BuV3B9xkl1Y1q1Pkckyi4tuNg53aw

Protocol

HTTP/1.1

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Proxy-Origin: 89.238.142.212; 89.238.142.212; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a76afcc3-d4d7-450f-9702-bd74463b3461
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Proxy-Origin: 89.238.142.212; 89.238.142.212; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 881b4610-4c1e-4d18-b2ea-bebfa0411382
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELS7I6e4--Pf2RH8Zd4uUJc%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 23A6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjAzNjc3NDk0NjE0NDkyMzQyNA%3D%3D

170 B
188 B

66ms
65ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjAzNjc3NDk0NjE0NDkyMzQyNA%3D%3D

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Proxy-Origin: 89.238.142.212; 89.238.142.212; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5e99da6e-f6e7-4eec-ba96-66dae35ebde0
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjAzNjc3NDk0NjE0NDkyMzQyNA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame BA09
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/902252/59081166/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEA...

68 KB
23 KB

259ms
88ms

Script
text/javascript

142.250.27.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.27.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ra-in-f157.1e100.net

Software

cafe /

Resource Hash

261d96c1395d831efccac50b137c6f6eed71d8bb8a55d5489793a03b070a1a7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23091
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-server-name: app25.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame FDD2 80 KB
21 KB 62ms
62ms Script
application/javascript 2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 6645880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
content-type: application/javascript
x-amz-cf-id: 7FyXsJBjNTVqyjPhYQcadbEPNixzF8WiOoDhMoNGln-UBZ05xiOmNg==

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame BA09 43 B
301 B 396ms
124ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902252&asId=9c50e3b6-23e7-b7d6-6281-0b964dc67322&tv=%7Bc:x21U98,pingTime:-3,time:64,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:16%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:64,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B60~0%5D,as:%5B60~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sRPqGGW+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17,idMap:16*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame BA09 43 B
301 B 395ms
125ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902252&asId=9c50e3b6-23e7-b7d6-6281-0b964dc67322&tv=%7Bc:x21U99,pingTime:-6,time:65,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:65,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B61~0%5D,as:%5B61~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sRPqGGW+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17,idMap:16*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:www.zdnet.com*&br=c
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 B26839220.322047744;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;nel=1;dc_adk=1575238846;ord=vo35xl;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvGKhmmMUPcZu0AYym4T2... Show response
ad.doubleclick.net/ddm/adj/N781874.3385329PMPRECISION/ Frame 1428 69 KB
26 KB 139ms
139ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N781874.3385329PMPRECISION/B26839220.322047744;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;nel=1;dc_adk=1575238846;ord=vo35xl;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvGKhmmMUPcZu0AYym4T2ZCTdPKMfP9kxLr7t9EkPTNE87bnyAvQMzi2hKzoLPe6tNgp_snY2lJIDEgync-ajxVlZS0Sc7jA2gzdDgDcMMyGqWj6LFLD4l-TFCiW37Tg6paaujUIwwpGHS1QTzJ3VDzBVEaIE8iFFya5S3itTwdn0roZcVxZoMDnasWfKAe4LDBfwdlctA2tfcjkYDi27OKk_97ztI-r0rM0tfVhz_zoDkC69W6vNYt6M69Cn4CQWWUfj9VsvLV2zbxvZqjl7MjEtkfKUtJ4AjmPRlQ7a7HWkNEl1kydtcbNrYBVHsEm0UXrtGrNRv-6OHEQRcvwqxX%26sai%3DAMfl-YTlqWd9ktUK3GfsmbNy0-fNttKu4zdJvapulmYYiJppnnxk-4mt8m-uYwPFlS05VyqYJ-fYTSTniIjIpjHzQ9csKepKbfU5sNN8UTRYZP-Z0ZE2gauecOagEfP7S7tp%26sig%3DCg0ArKJSzADuyZQ0P6IYEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DCfnPudSq8YYDTEpn13wORopPYBbjk0uxmu7uvr_YO_avE14krEAEg97vHgwFgu4aAgNwKyAEJqQKtTufz5li2PqgDAaoEigJP0NnQNaCLbScPQTYmIuBMkQ-6021XFek_PPduNZS2_qZesUoGKcc5VILZoK3CF6xDis1ICIYlfDU3vU1pxQNGgKsMEBz6tQ-yiTQ2njvEXs1DaBciBmw06tjCsd5q-bUHQK4cAjXv8fQinEd0lhwzibeEtWE2LZd6BVbqF2yDl3S5W98e7b521TSl9z3Rfg-zZ3mu3LGk7gKFMZjXtM6AIEJZnXJwzd0aZcxp5ucxq1Q3prqp86JCfBWxm-Aiu_Q_2Fu34ITRn8m5NgWbQQcCKqT45kIH2GAYJk91xLAQPCeZR7aNVHFkyJ1OIdZ5d4vQ9nDTeB-xKoyyoWvphMEK52kSBiXR8w68gsAE7IbxuegD4AQDkAYBoAZNgAfi747WAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATyMe7DdATANgTA9gUAdAVAYAXAQ%2526ae%253D1%2526num%253D1%2526cid%253DCAASFeRozEs15nMjOlPc-QEBivqj-VpTZg%2526sig%253DAOD64_3Nshhrn2U5xLcN0R0e9sZ-bFvg9w%2526dbm_c%253DAKAmf-CVSvCnvbDqNW0CyWRF_QunNVnRGf9KLNbSDMYPSp4UJpwAdpGciLwtMWFQovB75rPEgWNx0xUbFzDqmDXHGZ2F5-ERvkaU2KaEKkaX8qXdkIPNgL4ICzof3qyDbFjJyOTN_BhfB8AsojpnlWsbyfPorx2ong%2526cry%253D1%2526dbm_d%253DAKAmf-DnZjFCaHePnL_3Wnn-AB-zw1c5L_SLlKJb5Bde1usMo5W8dcsENdDkwXafa4L3JGW_rX6RhK7E9qwpi_gcVMRKJpY7EKJ36SUF9bjmYvPfALsWq3EsNby_kXZHc-H4mMkFG-YEWZVJMwJOrLqxzMEybXN768GBTX-n8uXCN0Oo_XNbMsK9EUg2hgPFvSusjWL4Su10Hkugv-YKY3pqsfdZP53JiXIlT4V9UzHblfaodB627dw%2526adurl%253D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68$0;xdt=0;crlt=CP!F4A-''g;sttr=111;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef8146ba1b2688b95d2b826cbd8c9474ea00775a9a8ced7763a6100c216ed932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26770
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame BA09 43 B
301 B 380ms
125ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902252&asId=9c50e3b6-23e7-b7d6-6281-0b964dc67322&tv=%7Bc:x21U9p,pingTime:-2,time:81,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:436,beZ:437,mfA:439,cmA:440,inA:440,inZ:443,prA:443,prZ:449,si:454,poA:455,poZ:476,cmZ:476,mfZ:476,loA:502,loZ:503,ltA:517,ltZ:517%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:16%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:81,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B77~0%5D,as:%5B77~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sRPqGGW+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17,idMap:16*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,sinceFw:62,readyFired:false%7D&br=c
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

POST
H/1.1 204
No Content /
02179910.akstat.io/ 0
354 B 256ms
91ms Ping
image/gif 2a02:26f0:6c00:2b9::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://02179910.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 957C
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/903347/59128492/skeleton.js?ias_dspID=64&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

53ms
53ms

Script
application/javascript

2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 08:35:57 GMT
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
age: 14074634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: nCXffagCKenblxToRHqmc3s7V4udnA2cvj0R9bSiyvz9Jvfa_srv7w==

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-server-name: app16.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 03F4 80 KB
21 KB 101ms
101ms Script
application/javascript 2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 6645880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
content-type: application/javascript
x-amz-cf-id: zpbGG2XqUlpTGwIh6rvnquN9Jq69g_YsXCTiHna2xHi-dK4dFu0mLw==

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 103ms
81ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=41&fi=1&apd=82&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5029899480&L2id=2942419878&L3id=5840893800&L4id=138375198146&S1id=22308610192&S2id=22654085702&ord=1639721589820&r=323435141851&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad-plus-leader%3FT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 102ms
80ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=41&fi=1&apd=82&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5029899480&L2id=2942419878&L3id=5840893800&L4id=138375198146&S1id=22308610192&S2id=22654085702&ord=1639721589820&r=323435141851&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad-plus-leader%3FT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 100ms
79ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=41&fi=1&apd=82&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5029899480&L2id=2942419878&L3id=5840893800&L4id=138375198146&S1id=22308610192&S2id=22654085702&ord=1639721589820&r=323435141851&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad-plus-leader%3FT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 66ms
64ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=554&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2769&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=0&ag=41&an=0&gf=41&gg=0&ix=41&ic=41&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=41&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=82&cd=0&ah=82&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1773634322&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 178ms
114ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21Ub3,pingTime:-2,time:475,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:11,bdZ:222,beA:316,beZ:317,mfA:711,cmA:712,inA:712,inZ:716,prA:716,prZ:720,si:726,poA:727,poZ:739,cmZ:739,mfZ:739,loA:746,loZ:747,ltA:791,ltZ:791%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:105,t:409%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:475,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B78~100%5D,as:%5B78~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs,slid:%5Bgoogle_ads_iframe_/22309610186/aw-zdnet/technology/security_0,google_ads_iframe_/22309610186/aw-zdnet/technology/security_0__container__,nav-ad-plus-leader%5D,sinceFw:64,readyFired:true%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ Frame B0E2 43 B
260 B 242ms
77ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=33&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5822723755&L4id=138370913061&S1id=22308610192&S2id=22654085702&ord=1639721589848&r=924275258455&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ Frame B0E2 43 B
260 B 242ms
78ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=33&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5822723755&L4id=138370913061&S1id=22308610192&S2id=22654085702&ord=1639721589848&r=924275258455&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame B0E2 43 B
260 B 51ms
51ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=1&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F14375432174040730625%3F&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-Z%2Bh7GydOacklaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-4MFnRoeeeVpMDA%3D%3D&sc=1&os=1-IA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=128&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=84&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&cu=1639721589848&m=563&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=128&le=1&lf=89&lg=1&lh=19&gm=1&io=1&ch=0&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A184%3A293%3A593%3A433&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=33&cd=0&ah=33&am=0&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1493211760&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B53D 22 KB
8 KB 49ms
49ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 16 Dec 2021 15:05:28 GMT
expires: Fri, 16 Dec 2022 15:05:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 54462
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 E=ls:on%20scroll%20full%20collapse.1
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=370/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 235ms
235ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=370/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=ls:on%20scroll%20full%20collapse.1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 E=fq
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=0/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/Q=f.1_c.1_p.1_l.1_v.1_f... Frame E33E 35 B
159 B 234ms
233ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=0/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/Q=f.1_c.1_p.1_l.1_v.1_fc.1_fp.1_fl.1_cp.1_cl.1_pl.1_pv.1_lv.1/G=17dc705de9b41b1eb14199e/E=fq

Requested by

Host: ad.clipcentric.com
URL: https://ad.clipcentric.com/user-9/resources/store.phtml?v200530

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ad.clipcentric.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame 772D 801 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b526196d510bc11f40effba13f1b9e1792120b1f40b453695e8d7dcc05cf38d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 1428 169 KB
59 KB 213ms
114ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Origin: https://www.zdnet.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:13:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53958
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 15:13:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame 1428 8 KB
3 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N781874.3385329PMPRECISION/B26839220.322047744;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;nel=1;dc_adk=1575238846;ord=vo35xl;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvGKhmmMUPcZu0AYym4T2ZCTdPKMfP9kxLr7t9EkPTNE87bnyAvQMzi2hKzoLPe6tNgp_snY2lJIDEgync-ajxVlZS0Sc7jA2gzdDgDcMMyGqWj6LFLD4l-TFCiW37Tg6paaujUIwwpGHS1QTzJ3VDzBVEaIE8iFFya5S3itTwdn0roZcVxZoMDnasWfKAe4LDBfwdlctA2tfcjkYDi27OKk_97ztI-r0rM0tfVhz_zoDkC69W6vNYt6M69Cn4CQWWUfj9VsvLV2zbxvZqjl7MjEtkfKUtJ4AjmPRlQ7a7HWkNEl1kydtcbNrYBVHsEm0UXrtGrNRv-6OHEQRcvwqxX%26sai%3DAMfl-YTlqWd9ktUK3GfsmbNy0-fNttKu4zdJvapulmYYiJppnnxk-4mt8m-uYwPFlS05VyqYJ-fYTSTniIjIpjHzQ9csKepKbfU5sNN8UTRYZP-Z0ZE2gauecOagEfP7S7tp%26sig%3DCg0ArKJSzADuyZQ0P6IYEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DCfnPudSq8YYDTEpn13wORopPYBbjk0uxmu7uvr_YO_avE14krEAEg97vHgwFgu4aAgNwKyAEJqQKtTufz5li2PqgDAaoEigJP0NnQNaCLbScPQTYmIuBMkQ-6021XFek_PPduNZS2_qZesUoGKcc5VILZoK3CF6xDis1ICIYlfDU3vU1pxQNGgKsMEBz6tQ-yiTQ2njvEXs1DaBciBmw06tjCsd5q-bUHQK4cAjXv8fQinEd0lhwzibeEtWE2LZd6BVbqF2yDl3S5W98e7b521TSl9z3Rfg-zZ3mu3LGk7gKFMZjXtM6AIEJZnXJwzd0aZcxp5ucxq1Q3prqp86JCfBWxm-Aiu_Q_2Fu34ITRn8m5NgWbQQcCKqT45kIH2GAYJk91xLAQPCeZR7aNVHFkyJ1OIdZ5d4vQ9nDTeB-xKoyyoWvphMEK52kSBiXR8w68gsAE7IbxuegD4AQDkAYBoAZNgAfi747WAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATyMe7DdATANgTA9gUAdAVAYAXAQ%2526ae%253D1%2526num%253D1%2526cid%253DCAASFeRozEs15nMjOlPc-QEBivqj-VpTZg%2526sig%253DAOD64_3Nshhrn2U5xLcN0R0e9sZ-bFvg9w%2526dbm_c%253DAKAmf-CVSvCnvbDqNW0CyWRF_QunNVnRGf9KLNbSDMYPSp4UJpwAdpGciLwtMWFQovB75rPEgWNx0xUbFzDqmDXHGZ2F5-ERvkaU2KaEKkaX8qXdkIPNgL4ICzof3qyDbFjJyOTN_BhfB8AsojpnlWsbyfPorx2ong%2526cry%253D1%2526dbm_d%253DAKAmf-DnZjFCaHePnL_3Wnn-AB-zw1c5L_SLlKJb5Bde1usMo5W8dcsENdDkwXafa4L3JGW_rX6RhK7E9qwpi_gcVMRKJpY7EKJ36SUF9bjmYvPfALsWq3EsNby_kXZHc-H4mMkFG-YEWZVJMwJOrLqxzMEybXN768GBTX-n8uXCN0Oo_XNbMsK9EUg2hgPFvSusjWL4Su10Hkugv-YKY3pqsfdZP53JiXIlT4V9UzHblfaodB627dw%2526adurl%253D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68$0;xdt=0;crlt=CP!F4A-''g;sttr=111;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:02:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 653
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 06:02:17 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1428 41 KB
15 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54462
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Dec 2022 15:05:28 GMT

GET
H2 200 main.gr.19.8.273.js Show response
static.adsafeprotected.com/ Frame 1428 187 KB
60 KB 83ms
82ms Script
application/javascript 2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.273.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/886082/58856297/skeleton.js?ias_dspID=64
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 00b3b0b438a1a3e7f01112f487ffb01e64db47935eb0e1e2927bdb4811ee935f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 10 Dec 2021 17:46:17 GMT
content-encoding: gzip
age: 563214
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 10 Dec 2021 17:31:00 GMT
server: AmazonS3
etag: W/"dbbed9b42f871ade260381ef78b0cd71"
vary: Accept-Encoding
x-amz-version-id: RbTKyuj_rScIKJ79M7NB4z2hCQfzt2bN
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
content-type: application/javascript
x-amz-cf-id: jVZ51NFTBblsxdAaSRbrKn4aGZyrWn_i1CErJdA_XrNW85QgakKIdA==

GET
DATA 200
OK truncated
/ Frame 1428 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: efdfbc7761acd2e415ffb57be691b40856508557c56c10de55cd6827ff83c1c2

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 61ms
59ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5026379933&L2id=2945788752&L3id=5848202531&L4id=138373623368&S1id=22308610192&S2id=22654085702&ord=1639721590483&r=850542442564&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 62ms
59ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5026379933&L2id=2945788752&L3id=5848202531&L4id=138373623368&S1id=22308610192&S2id=22654085702&ord=1639721590483&r=850542442564&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 62ms
60ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5026379933&L2id=2945788752&L3id=5848202531&L4id=138373623368&S1id=22308610192&S2id=22654085702&ord=1639721590483&r=850542442564&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 63ms
60ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=199&fi=1&apd=240&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5029899480&L2id=2942419878&L3id=5840893800&L4id=138375198146&S1id=22308610192&S2id=22654085702&ord=1639721589820&r=323435141851&t=hdn&os=1&fi2=0&div1=0&ait=79&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad-plus-leader%3FT-1000&moatClientSlicer3=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame B53D 35 KB
13 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:53:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33576
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 20:53:34 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 141ms
112ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21UdL,time:643,type:e,im:%7Bimprf:%7Bttecl:914,ecd:54,tsecr:59%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:643,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B245~100%5D,as:%5B245~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ Frame B0E2 43 B
260 B 81ms
80ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=200&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5822723755&L4id=138370913061&S1id=22308610192&S2id=22654085702&ord=1639721589848&r=924275258455&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 1428
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/886082/58856297/skeleton.js?ias_dspID=64&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23...
https://static.adsafeprotected.com/skeleton.js

17 B
465 B

72ms
71ms

Script
application/javascript

2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 08:35:57 GMT
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
age: 14074634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 88n2Zjcs4YUKlEtyO095tSY9xJNuM096k0vsEwXczFG1UBy3XdQH-Q==

Redirect headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-server-name: app18.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame D8FE 80 KB
21 KB 88ms
88ms Script
application/javascript 2600:9000:225f:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 6645880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
content-type: application/javascript
x-amz-cf-id: HfOzJpC_OHhMkTpTZZcrieX8Cce9pGc-_cf7bzUoSrH_TiOOVnWNiA==

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 142ms
114ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Ueg,pingTime:-2,time:140,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:6,bdZ:87,beA:434,beZ:435,mfA:548,cmA:549,inA:549,inZ:550,prA:550,prZ:552,si:555,poA:556,poZ:563,cmZ:563,mfZ:563,loA:569,loZ:569,ltA:573,ltZ:573%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.600,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:140,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B24~100%5D,as:%5B24~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:%5Bgoogle_ads_iframe_/22309610186/aw-zdnet/technology/security_2,google_ads_iframe_/22309610186/aw-zdnet/technology/security_2__container__,mpu-plus-top,main%5D,sinceFw:18,readyFired:true%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame BA09 169 KB
59 KB 200ms
59ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
Origin: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:13:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53958
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 15:13:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame BA09 8 KB
3 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/902252/59081166/xbbe/creative/adj?p=APEucNXuVEPKKbEcScmiAGfGZg6P0FlWt_F1SmiA_2kzWdTiffXXOck&d=CnkAoCZ_4K8eixAkojrxQ4Fs2rRugfImCP9b-abBO3P5gExwcn8ThOD8udo5Ojsw62cdiiBi8u4DApKd8OjfIytEAvDENwRyEiC6x7pFN9cWZKU5BSTpljkN1KyFbOa8U7gRW45qiwniN6aasyI4TnzoQxdKPbBM7xFmEukbAKAmf-Boxew7AzpMd7j5gk78QqCcYGAvG_e9pwqoFlDQhf3tnorze2OVUgjX5WCwZGxBUcvwxI5hANdcVSpw0A4hCab6nnYnYix_aYgXTYxF1NviKDjMaYqJovGpyl2bxo3oJLaec19xlxn2PL_LbdjIhSAaFs7JBTjYG3B4aHJG39MnMFSsNne1_0OP8QTVXSBPt6uHXW_u4itDJHyNBapIeOxHoGAA5P9WcxpOVcw8CYxu17Wo4yA3GHLXoV3xBx9rQmIl6lctxQ6Hfe0XpO3NMQuqiHj05zM6hO-Aexb_ieYUP-jjIegOxx-4hPQodBrQTIOQm7A6Jci7CXeRNw-OzLSfSf_wXxn3sjS5mCbfsV5qqtcrS8JP58YiLfDhHU3GZwvd7djIdmT4-Wnv2oCsd-zguPrEraQKEArlC0g2TEDt8GbYEILq1dYTecWRGxHjox3NWIS1A0gei9wudfw__nvaBWiRoBzdZ5aFkxsITzojaBwfRCI2ZTd3UWEuE5xopCBSCugcR8ndB3Wk_XGy95uu65M5OYZyJWBOKFOinE8fimOl-bpC2fvK98tBNuKizAxpvYKp25w-Jy3R67N9K7VzXIByhVhQ5-nWPdb9qkPPioe56mcdcWgNAJXCLg-ru7wqScsc6hCfjFlLRgSl7kwM6GMSGJWdHWYTnStrOxwThifLvuakFWyiOkwYvegOnUHPwLKLlX71bAYHrbAYQQRPirRJD2_WNxG9e18DE9vYF9AZO2ejLo_t1AVULofe2RwETNmv2L7M0aURB7V17qadXpQ8qCH7ywZY6Q6Q955PFnXTLTs8ygXU4MAGnvyazDWuV61il94YzeFtKBPv94eMgLQRzfD7CPjtG09nRsz5fnYmTUKltikuRfb9vuu6aQlMAXSBgCC1cGbMoXFCUB2HORskRU4A_rGSAF_OPIqKQp3Xr4WAFeRPTbFiOt7uHu3JHo8HCLcdMiaOoFrKQDUrr42yokqwu6fC_tg9uoH-hddMWUF2PJAAfnZVqZLIEFr9D1DwZsyhWEiMFwiWl9of5U77a3JTWMPaPrPmErNQ4AoVosfoUBtsvaZ093zZR5eKSE50tFHgGbjY5lgNC14d-y_0k3lOkzQEsoKEm9HJwqP4zuwNeN6bc_ENeq0E7ekEDfYnhLoykMgKwWlB9DmOOJynRTzZ20wNL-bi0tzj2Zwg2taE04EtW3Xabrj1HnLa9pFfyYuEpwK-nLJ9l_11HyP34-AGFo9t6duqwXxRJ0mm9pE5SNTyPKN4AyhifJTX3teWDJhUDSK2-uweqOdrKi2ZYBvZWIOzAHOjOCZuF0CWuIbOP-edb-voDidm858NAe4tMiF46iuOOFPzmtDx2EAdUWxJ8EhiodLIH917uE6qShwy1qRIXt23BEXhcakBcGnQbYpz2T7Nh8CGanJV2lqMb7KW3RUyDMAJI3wOGZG3l0rY1AzZAOvfj2GelwgkgUZY0tXPyYVIxH1OamCle3m_FchqjQnMDIyl2U5CfyuQVo_X4rxGGXttpBkV2OqhjzUVjcpNUnb4Gxgu2HHTUocUcN8m__ea-GmtZmMf9qWUoqLJp-YgrQp0yJF0j5NIJovjcl8-eluKoHrX75x3PQnsJ-JEuEXDDQER75xaUwr-EIrVRfL5ezbnBTU7quaCk0_0z_kPTnd8bc_sfIIOYTkmYweCIzp-MaxOA0r-Dx4lQBq1oXOv_VDfGbMEvQZi_zQTPhZk5ZhvVmf2cjVtW5KexuZLt7yQ6fC9RDO8RcVO-joPu7BlOaawSPTbOCANByu2j8D2Dm9mTIbmL__OHChLk2mM1PSQZvpL7j1LkYO02dXJRjYEgojl0-hskBxcbHAjWp2zgfbo7zB2ObnJ0-4vYf3OrybXo__iUFq6fOtQNAPXIBYtUOHxIIJMVls6SGzfXP99rudmDjVgtlWc5j0s31KnLcSPqh8M1XdgTOUKWFFFrJrJKsar1hYmY1krwLBTC1SB1LjrzOrexoxwSPaaImv8PmT2l0xtWzrJa1LBEq9PFiQ57y-JcDR3MTrYHLIqFKppLbDD12GNfE4ZaRijAAXcw_ZOdQX3jDCpjOfBd_QKVdwmHGvgvmZwpIVuVizTExbDn9utmjbZCDn-POXPx8KCDJNO8SNoLhPF74o_yzY4KIPsbH1c012q1PTdE6MNBpxFkIwUR66FUDdaeshWYlq-ASCqcxRARHIMqk4tsMBt0K5AwxeFdy5VSpo8dGjv9rHzpyCVKHjzRnFYcTY0K4EkjIWWvIJU93pJdNijzaF_23YCr0DHkhh7VDYg_GRb1G9-H1Zzy2G9aSHNnazeDVzG_aK67caPAQLyNgB7TFj5h1IILUudXZz5aWUpHtkeoLgKD7p46kv6yvYeJi7DORsAqMbrafq5yPFfE24-cj56GDrzz--gsIMrZlvkEIg-TDEYNpIyMUlRLj0nHpU5JAy046hV-RLS5WXURf41c3IVTBAUBydL7MTotTPGXwzyYiXQOsk6V46J96vsMFke4oIl6P2O7bdsLwNly8FjXbMqCSxL5EzQdmVkPhCTqNwa90sirnqOQ9XSbppytTzmU3ctnvECLfKuDHxZGt_xJLd7C07un08IoiZMcue5qM51yfFcsvKVmGUY3Yn3hwqHnBCEJOFYRQYdbf_lLTf9GXMEYKDBUfTkXQafuwUoPiN0aX9S1X8PPnPdyGiRLHrnN8lkGUGnw-BnDhmQiGUpV-DnDhgWoFfYVXBx0ti3nV06BgfIYgaX5OeA20rYIdK7DQYUa17maCCMU6wudKku64j8CuGCZ0yz1MjVOQ89QqXxtCTWF5orBDlVjgGGdQl478uHUhi5svqUfdNb5rQtLG5KZWRFmWKDZW_48q2LxQ761ZIfGveYTCjo-u2G_IFWDpCfEqswDFcR0q5dmowE-mPeFdOPLZYVThDc1Esjo9J8wnk_if9ZBWz5gIwhjaW3Je9pRP-KKEe4gH4e7ZKj-sN1YbvjARjpAYP8dUAfJd9aLmrGI8GH-XQXFeAbW-GRZLO_oFDusKhx_fPLYh_UVzhTMWwv2HOQs-eKMZY8M4PTo7buQ6-B5iMJtt6bjwOCAI79gGwlfm5zCO-UUKz9H1cbhnZBaDOd7kAdNgaCwjvhU2JxNmM33Eo29aKrZ-1SbT8VqHcbG02DnscU51mtT3Frc0vGXO7XY0FMz9r7SQK-ZBFcXFWqyuCUGC3xrnV2am1mg_T4QXuqlvYDMMRf1zQkr6MgjFNS-4aEeIcMzlMwx2syeh0gE-BjI_4wFUGvuPp1COKVVFvjYAG5T5Bm5r8ZRzBaTr0Ut6YDwSXoOWZuNMtELRluTn5LfV5ozH-TRjQdGcIKXVfW0-BqClM8eUCyB6uXyqomrthw3tblTV-KFjWeFG2HMWpuvWH8w-mfoawO5U8jUMs0dBvRBh7hoMA0W4pAjwNCbWmIEPJM2gdBoKeyUVZxTi2X4T6EgAqXj5DfoEAdTakvvgFK72JB0v3igKcZu7JmCWayKiLm8LN-YYRafYVzwHrrqVqTJxbyenswDWQtdBcmCjhJLxNAG6PqI2CyEqB4n5G4rNVp_aJoEbktoA_ntSEnETlC04uqlQpaCnn6YCZXnunq0kJEjG3FjyYCgpm6l-vt-WdyLN5VC2zu1Q8C3NeWiblYdl7B6W2v7gNU3yH7jZOnplAJKoIniM-Xk_Ceu822FzCfhO7xtm6cAG9Q2ghw0lDClClvE1bSfLJtj9G4i4Kcr2ax5Za4MrRMUdb7SM9FelgzbEhpNsaRXZ_ta3YmCXGLKLgRnhM6F76IWv9IxLG1Si-S8CVjyMKhkbVPSVvQwyml1eGFIptAbriJmFkJiqR2E9rLIy9xprfO4w86NBTxEs1PzNNiREbu6-4ZYVJBCA28mC69lclTmqsG0tzTCSR2LjOT_yp4YdBW9bFbASp-jPt_MR2VK0csEswNHRoGA40awy9wjiC-ppSQ9vUt-TkQgsBqragUzigeJlPEIamQg459aSCT9GzTYgyOi0DlsnpMOtFaKLEeCWbJGSzDYIph6IfCK1HmDQo4qQV47kEErlYo0_5zMYgxAKJZ7_O8efv8HsCtGhFOY4LF_tIeL9SOvqAZRcanHbzkd81DEmOxwImOhKkl6w4Tmgzb_tlZkz-ibWNv-PxYz_zsqc3xiecwy_Y2E-FRf60O-qdZ1-VGqXMvCF8wQMRRr5UTsAIsd7UMqL-d2ouafdC3t9dSXrCsXl0BGMxB7mDL0gHKTXeLnTkG34qO5E0ag1FPv8zsKg68dInrRzPp3sEuH8Zyb1Xo9kbo1SP_Vf0jSjGmCovTPJ05HANpv17JlJAS4h4K4tQ18v-65S7xPiOTli7RnKOEcwtioHdGbjn2S6L2Vm-_wtnm9kjL7B_199TojsAAq0yvsmF7h7Iu7limVwWWyQtRA0KoqpQmwFV2jbzgodWkMjI56sjHdAFc3JUOYYuNG8Tglkm58pUl3cUglJiG6ShPTbnVkWNelVI0Z_D--QsJ5m9PDf3l0iV7Cjzf5zW7g81D9qcpeEwm-zZmMh2DGu3c01WFpQxWn88CZWk-qTI3qh4d6EZcn_3DSqDN3qmGxmn9pMRoASRxc7IvDIwHa7vEsfLU29EaCZvUubspfH5-TkY0t7FPYfx8M2i4Dj0G3TjkIUzGko_dM8o-s9JwlfYWxJDau_Tv304ePBLwMX6cmdjw2tB9LkmRkDQ82IoIx6zBbYb8GhkIABIV5GgJSzEXOEa4R3jbaRHnCYWbvuJiYAE&xfc=https://adclick.g.doubleclick.net/pcs/click%3Fxai%3DAKAOjsvp42hbFqoglj8LmnP3LS6MF6mgwRAfacByOzcB88NgQJ4HiE4nEhdiWXC6gUh3wJ3UoN4StE2CDs-26vBLyCCfmrvb8-mQWZgUSm9dqE-xYN2d54MNkxykHPrcrg4hLo6WYfuVcRo7jvhs_bFRsLt0eJc7vNUqBS8SDes4G-KCbK-kqSd7kGA8qU6LjaXFZlIAkMwO-Jd_KJ_U7eAcJDB-8UIZleTvw4if-GP3P8Pzuk0j4XMv8XZgGo_UnjxsFDpgAXO4S52eHYfDFIwGy4x4flnSeHTMjWZ92bWbQdGT3dQSM10DnjkPWLEa-I6H7ohassAYwQptiOZ3TOLZlLNS%26sai%3DAMfl-YQComW1TU4ITp_ZmMWOl0YwfKvHxiP3tENGk6fbmRtp1nxg8lU91H7MRMnQrqSqJSRh3aIF6WBFGdTEfsCyavKKOwKgi3a-weZdVrRo40fjgtfNINpYwZ9bP5Hf_LdM%26sig%3DCg0ArKJSzKUrAiwdm1cTEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&ias_dspID=3&ias_campId=25634041&ias_pubId=pub-8820362605711196&ias_chanId=1&ias_placementId=15548172663&bidurl=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/&ias_dealId=1804173&adsafe_url=https%3A%2F%2Fb6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Fb6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:9c50e3b6-23e7-b7d6-6281-0b964dc67322,c:x21U8m,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-6d588df4d9-k4wh2,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:2,fm:sRPqGGW+11%7C12%7C13%7C14%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:17,oid:688ecbd5-5f00-11ec-8929-e642c24959fc,v:19.8.273,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:02:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 653
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 06:02:17 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame BA09 24 KB
9 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 05:59:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 796
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
server: cafe
etag: 14328493792227503680
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 05:59:54 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 56ms
54ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639721590483&de=850542442564&m=0&ar=cc97a930ec1-clean&iw=101177c&q=10&cb=0&ym=0&cu=1639721590483&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1216%3A1216%3A2516%3A1207&iq=waiting&tt=waiting&tu=waiting&tp=waiting&jk=-1&jm=-1&fs=195926&na=1063577627&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CEC8 22 KB
8 KB 57ms
56ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 16 Dec 2021 15:05:28 GMT
expires: Fri, 16 Dec 2022 15:05:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 54462
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 E=fq
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=621/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/Q=f.1_c.1_p... Frame E33E 35 B
159 B 132ms
132ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=621/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/Q=f.1_c.1_p.1_l.1_v.1_fc.1_fp.1_fl.1_fr.1_cp.1_cl.1_pl.1_pv.1_lv.1/G=17dc705de9b41b1eb14199e/E=fq

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ad.clipcentric.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:10 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame BA09 43 B
301 B 207ms
100ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902252&asId=9c50e3b6-23e7-b7d6-6281-0b964dc67322&tv=%7Bc:x21UfE,pingTime:-10,time:468,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuOTMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1639721590689%7C%7C8dd4685289963238dd10aab6725039ac%7C%7Ca2fdad25d911a8a4b39828759d282361%7C%7Cc48c1659b192c6836cf5e69cf88de3fa%7C%7C6f26d4a8d9bc48fb949a895156a653df%7C%7C997a759e5943bbcde271433b20107645%7C%7Ca1116cdf933c339f53322b9da785b20f%7C%7Cd0e1d2f286021c4d69885a47bfa877b7%7C%7C1629390669%7D
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 55ms
55ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=206&fi=1&apd=208&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5026379933&L2id=2945788752&L3id=5848202531&L4id=138373623368&S1id=22308610192&S2id=22654085702&ord=1639721590483&r=850542442564&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame BA09 0
0 73ms
72ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPIK-EH_eS8V8Tr1iQ30N29CZrs7l82qtI5lls2OmFSLlKDCfGIU8QljIpKA9XnLvrc4x_FX4wN6HglPcyIshnI0T-Zz8ExlTp1C07dEdpvpdrOtFx27BwKgkB0QNEgNF3V_a9RYeeS3GWZBSCUQ1cy_SPukOylL4_H3CiC9Q__ZwSGT90uVGv2GOtxYqO0A5eOYvegnU59K9veyLe4GgEeZtMAnQfkIAwr3kKXPZs8iCX_FKH-bglyZiPd_AXjv3pW43dqG2ODf8hXypqHvOVCucwzbnfnt9uz6GyJ-x-ZywMdHxQIZblA0jaDv8Uzlg9tAXyY7ZU6mZdRdoOolv1dKfJjv0&sai=AMfl-YReljuJTfnDq8TVnlAb70gMNMb3m-RviV4UKT-4TMjW667OQwNDPZKF_toNjMha8d9cNDSdPZEh991KVGrhSpWCmJmRa49JowjSAg7p3UcgFheQJoFFsawQ6uN0UN6S&sig=Cg0ArKJSzL16iGmvhVylEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
DATA 200
OK truncated
/ Frame BA09 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f65966ea4df3c85a87ac07ca39074efdd91c50b2bd0d2d2ebc19da3964d3a2a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 57ms
56ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=13&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2764&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=1&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1977144481&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:10 GMT

GET
H3 200 EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response
pagead2.googlesyndication.com/bg/ Frame CEC8 35 KB
13 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 13:32:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60026
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13555
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 13:32:44 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame BA09 43 B
301 B 101ms
100ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902252&asId=9c50e3b6-23e7-b7d6-6281-0b964dc67322&tv=%7Bc:x21Uiv,time:645,type:e,im:%7Bpci:%7Btdr:534%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:645,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B641~0%5D,as:%5B641~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:412,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16*.902252-59081166%7C161%7C17.886082-58856297,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 99ms
99ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Uiv,time:403,type:e,im:%7Bimprf:%7Bttecl:746,ecd:72,tsecr:46%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:403,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B288~100%5D,as:%5B288~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:215,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:10 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B53D 0
20 B 77ms
77ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6DNadiq8YdfOBou0-gbq3ZA4AAAAADgB4AQC&bg=!WVqlWh7NAAZKWFskSlg7ACkAdvg8WoSnuOuWaQslYCfwX5Hb247QL60oMn62NMpr7W7rrGIdyJBMdgIAAACOUgAAABVoAQeZAw962MMapZev0RGe4ElWf-Z6_rP4polXvDto7PT73BZHqIf4ELTFdfqkIgBfRc2_2aOLiH5hO3CpGv-i2Nyln2FkDG6Z7dKZ74_YlQDiSv2dEz8UCpvK4-3pGACll97D90om71VMsj3zCSjOU0DdL-CTB6JtPS6C3-iFWADnOLgB9Hg70hEJOVtMgM0EtDzjrM0OcN6fbprw4Z11acs9FIp9hYt7zvFtbF0BvmcOKJpwMGLzgWBZa5i3YjA8ppNllYoNS_bGs2vvgXY_C7rvuHeMPeNDjhE5JS42T_63lBRdzPh-us90-YDgyoT0m3b1FjpcU-nkqTepc9N_TghVBxGXllgwGcBKL2ChvX0EPPMYPaN5cA8xo83HuKhnqBT_jwk1J0bn0M9WKz_IYi7HJrtfgz7uW_bR_yyQmhlMCgOD3N0QJbR5gKuf9f5EAI7jnaDVSqUvVzY_K-1oeg_8mAxy6FS8Y9gcEuIJ52xCB99gqKmfiGQFy1-8d94cs6QdvV0XVyucIzoGDpIpk-fuBIVM_AITDGNS09fsIlptXvr0srgnL0NOygf8E1E6F7yfn0N3nhYDSXWSOj2Wf0h9ZNqA6CJX6pGu6tuh9C9g6T-9qOmsxBRxT_pJFZRMpMaImJnmPOEkSkfYtVocbCeq3o2H3DSbqPgNDqIvZaql5Kafoya9tlORAaE0YkpDVBRmq-twlnCVfHGY35QmaIFGY2-tSiXNcgtXIIkKuZYL_PvXBjAYc2e_J5UYL8usc6uN4Q8G4FORlzKn8pKkHGW_dB62vE_B5FTY5z-ccJrChimd5OmJDKIgYqnE2hofm-m1e3cLHCdDmeF7vBlI5fQGhmk8q7cIRSRdBi7tbUoKFLpbB_wRQEU5UqCQDzanBwgWdIlLc3akS7ReIDEMaMI9bROiR5HSOFuGeOMW9KQoZ7fGNB_w8UM_67Msp8nq3fhNRf4K7q2p_3icIMkZD6BM4RYWKEkqMVJR_4WcroQzt7EDCumC8Fail9S5G03CFQMlSO8JMS_YO8wf4Lcn0kC-OpE

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15574832698217520406/ Frame 5518 3 KB
1 KB 99ms
49ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecac033e3265c5ffd57f0f6205cf879f5bc4fef2fc324b5604f0f89e6c174a1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1207
date: Fri, 17 Dec 2021 06:13:11 GMT
expires: Sat, 17 Dec 2022 06:13:11 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 09 Dec 2021 15:37:27 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BA09 0
51 B 164ms
69ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuik3lVn2w50JKFu8JByUw-oOV0ddPhsCWm6YF9uQxRLZ1ymzhFszg_wupTBB8bxzkJoGJppV3KBGjTAeXxOgbpLr_jx51NJACAoXMDOQdq1hhvlkI7QBHlOh73HG2neMI&sai=AMfl-YTdGSnTdKGdq4NBsc-CcrqK4045Nyw_paAXBNkwiOzNEWgyW7SeHeEqBTJwppiRam11cniX7r2Z_8i_aub-gmiYH9LuNzdpQOw4IBQ&sig=Cg0ArKJSzBqY95OvxrHQEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=327&cbvp=1&cstd=317&cisv=r20211207.59083&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
samsung.demdex.net/ Frame BA09
Redirect Chain

https://samsung.demdex.net/event?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415
https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415

42 B
953 B

48ms
47ms

Image
image/gif

54.171.82.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415

Requested by

Host: b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
URL: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

54.171.82.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-171-82-61.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v025-0f79a8a00.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: LChcsFt+QGM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v025-031686f07.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: sz/NI9HNRy8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26910743&d_creative=138541485&d_placement=322804707&d_site=5234190&d_src=390415
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 957C 42 B
64 B 100ms
50ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst76Wy25KYxizyTf082RF4vI8iv1bH-O0weSXPir7uDYAkbhJPMqy334PhtvPU5OKd5gV8WnUgEpIyxxabmwvwbPSTCKS9XmHqliRHLIalwckMEuagP&sig=Cg0ArKJSzEaRY7YsqEMfEAE&id=lidar2&mcvt=1021&p=64,800,169,2400&mtos=1021,1021,1021,1021,1021&tos=1021,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=3529097836&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639721589614&rpt=313&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3214996305205785738/ Frame 0120 3 KB
1 KB 75ms
48ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c570b511db41f5583cd77a9a03276c2041045d8ed4929b4f1bd98a5545d4492

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1206
date: Fri, 17 Dec 2021 06:13:11 GMT
expires: Sat, 17 Dec 2022 06:13:11 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 09 Dec 2021 15:37:36 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1428 0
524 B 142ms
66ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst3ctwRgfwDTahZ2CjjBPx3ls7IKv7mZnuikYdZtqxj-JUauzXwKCBruhgK0FsFM_V4a8GYV1RyCBFg12RI5xRG2PGyn-W0A9GVicRSxGKjo1dBZEPHGBCkiUlLqxxfEjuPGdf0T4S5vtNyR0pb_9C1&sig=Cg0ArKJSzLsO3z6UFy36EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=501&cbvp=1&cstd=498&cisv=r20211207.27872&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
samsung.demdex.net/ Frame 1428
Redirect Chain

https://samsung.demdex.net/event?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415
https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415

42 B
953 B

46ms
46ms

Image
image/gif

54.171.82.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

HTTP/1.1

Server

54.171.82.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-171-82-61.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v025-05465e2a2.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 3974K5kzT6s=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v025-0d8b1d01b.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: pFoozzmsRfc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://samsung.demdex.net/firstevent?d_event=imp&d_adsrc=8297073&d_campaign=26839220&d_creative=138541494&d_placement=322047744&d_site=5234190&d_src=390415
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1718 13 KB
5 KB 42ms
41ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Fri, 17 Dec 2021 00:42:05 GMT
expires: Sat, 17 Dec 2022 00:42:05 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 19866
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6AE9 783 B
534 B 83ms
43ms Document
text/html 2a00:1450:400e:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4d53286fef493d463d74ff84299be6c2298e3b813bb52279c8c0049a0f23cd22

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vI1pOeflNTxjGpcUqw2i+A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 17 Dec 2021 06:13:11 GMT
date: Fri, 17 Dec 2021 06:13:11 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-vI1pOeflNTxjGpcUqw2i+A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 0120 118 KB
40 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 15:50:37 GMT

GET
H3 200 tweenmax_1.20.0_d360d9a082ccc13b1a1a9b153f86b378_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0120 112 KB
38 KB 137ms
136ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.20.0_d360d9a082ccc13b1a1a9b153f86b378_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b9597a90a43830b2a92897a5ef015ce5310e7f32dbb5cd1db2c807c5e6b036

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38407
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:33:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 timelinelite_1.19.1_e83510db25edfef4cf190ed4e5348d58_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0120 12 KB
4 KB 96ms
96ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/timelinelite_1.19.1_e83510db25edfef4cf190ed4e5348d58_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b9db45c7b730f0490aec270afd438e929bdc824fb5e21ce44982453cc03a542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4239
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 tweenlite_1.19.1_9fecaf2f68ee2520ddaa79e268d743a6_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0120 27 KB
10 KB 87ms
87ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenlite_1.19.1_9fecaf2f68ee2520ddaa79e268d743a6_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63b5f5e75af64e4f7f37759cc56d6a427fe98443c9f6663cb8ec6a688e00596e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9861
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 cssplugin_1.19.1_3e055071719ea45b6807509f844b72d9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0120 41 KB
16 KB 101ms
101ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssplugin_1.19.1_3e055071719ea45b6807509f844b72d9_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88d3ca80b7507885eececa9eb48c0d5c22c3d59487036dd4d9917cd65215335a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16483
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:15:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 E=wi
tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=1005/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/ Frame 957C 35 B
159 B 116ms
115ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317278/C=603283/P=22/L=21/V=23/S=juS5un2z/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=1005/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=wi

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 5518 118 KB
40 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 15:50:37 GMT

GET
H3 200 tweenmax_1.20.0_d360d9a082ccc13b1a1a9b153f86b378_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5518 112 KB
38 KB 126ms
126ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.20.0_d360d9a082ccc13b1a1a9b153f86b378_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b9597a90a43830b2a92897a5ef015ce5310e7f32dbb5cd1db2c807c5e6b036

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38407
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:33:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 timelinelite_1.19.1_e83510db25edfef4cf190ed4e5348d58_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5518 12 KB
4 KB 144ms
143ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/timelinelite_1.19.1_e83510db25edfef4cf190ed4e5348d58_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b9db45c7b730f0490aec270afd438e929bdc824fb5e21ce44982453cc03a542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4239
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 tweenlite_1.19.1_9fecaf2f68ee2520ddaa79e268d743a6_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5518 27 KB
10 KB 147ms
147ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenlite_1.19.1_9fecaf2f68ee2520ddaa79e268d743a6_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63b5f5e75af64e4f7f37759cc56d6a427fe98443c9f6663cb8ec6a688e00596e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9861
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 cssplugin_1.19.1_3e055071719ea45b6807509f844b72d9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5518 41 KB
16 KB 138ms
138ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssplugin_1.19.1_3e055071719ea45b6807509f844b72d9_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88d3ca80b7507885eececa9eb48c0d5c22c3d59487036dd4d9917cd65215335a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16483
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:15:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CEC8 0
20 B 77ms
76ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVHxydiq8Yb-UFIKdlQfH_a2IBgAAAAA4AeAEAg&bg=!mJulm9_NAAZKWFskSlg7ACkAdvg8WibeIgm2hcQ0inuNnflHTG-YAq89r5U98uek2YMCo4bprlyLwQIAAACvUgAAABdoAQcKADMqNjQUwteqGgu0PlUGd_HJQXPRzVdOvu1UmGU1dDWFcJe3jg1BkPUHVI5s2cScgUOGh0OZArXkO5juZIUsVn6BoMd6pVeDx0JeImj8wKvLXpGnUvqDdziUxuReqKIBQLc1uldECLZgipCxqz9urHAibWtdMQXkIrx-mB_DymUkWPiEi6HiRD-YxgZ52iH255vxKRLH0TGRnLVWXZvXyW89SvhwUYs60e6GLSOeMed5MR02FrxyDJGFrI1xNfgQEfGdxGbHmctRVJTFN-5jqyzLtApp9Btz4NoAxSoraweKDIyaKk7F_gpDH8Jn-3TJM4LKrBt1S69iNOrXLAQY52LZd4MY2Mmvmi5yvpRRees9Gqi4uRnNZFqME6_l6_mtw1cz0R52-5mXP27z_92tEAkn70JyNK2loi2Cqt50mNOmjUi5CHz6DuskFpP2W6gDml75FFOAggn7bnwJBCnMQS206gtpWPibn3HoI6_YJfGxqXM0ELKmnf0cJm86Gl_ZnjZ7BaT-gHeUfm4-NcOOG1r3uECo9yNy8k9lm9d55ihjHTO8-cWCB6YkyavXYS4xgLjcQ7eom9NwkGMJ4QGy6CrCYs7T1wvPEHeQszii4Wx0iNYuibvzf3m7dbWy1ijuKg0NtHgDB19jEjXu_sd-PVra4LhsUQjamQJmbrsQhDIC6J4CZBvTLhEvmA884dkaOmwdN6-cyW3CNDPcSQNtMtB35mEAZJlVbFWse2k6XK6Ds1SVzvF3vHQkI2WiPSOAGQPZeDw5pDSpJeNyCB8JskSsX54Grc3yEyBiMXmUTpkEz1tEcI9fjWP4vshGVUeb48o-oDJzJULf7wMcvIK5eIOhZz4ECaDvcdjrOpzHJ2vN5uI5upJsWSGA62TM0quA8PwTsHjxRGU-PxKmCY1Hj-zRpO1aBB6eVUSAPyRlRcBN4QbEywBu2Aox99p_tHySL-swlChNfe1GGXoCgcYi95wp-TTu4XLh1kGQ8JU

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 100ms
99ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Um0,pingTime:-10,time:620,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuOTMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1639721590689%7C%7C8dd4685289963238dd10aab6725039ac%7C%7Ca2fdad25d911a8a4b39828759d282361%7C%7Cc48c1659b192c6836cf5e69cf88de3fa%7C%7C6f26d4a8d9bc48fb949a895156a653df%7C%7C997a759e5943bbcde271433b20107645%7C%7Ca1116cdf933c339f53322b9da785b20f%7C%7Cd0e1d2f286021c4d69885a47bfa877b7%7C%7C1629390669,sca:%7Bspg:9c50e3b6-23e7-b7d6-6281-0b964dc67322%7D%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame 1718 35 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:53:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 20:53:34 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6AE9 0
0 64ms
64ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2021120601&jk=4411792276628597&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 5518 6 KB
4 KB 142ms
142ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc94bb20615ba7e788f5ce0c7b42cfcd5f7bf91c9bd0d24bc2c1ff4cc1984a4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4432
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BA09 0
23 B 194ms
127ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuik3lVn2w50JKFu8JByUw-oOV0ddPhsCWm6YF9uQxRLZ1ymzhFszg_wupTBB8bxzkJoGJppV3KBGjTAeXxOgbpLr_jx51NJACAoXMDOQdq1hhvlkI7QBHlOh73HG2neMI&sai=AMfl-YTdGSnTdKGdq4NBsc-CcrqK4045Nyw_paAXBNkwiOzNEWgyW7SeHeEqBTJwppiRam11cniX7r2Z_8i_aub-gmiYH9LuNzdpQOw4IBQ&sig=Cg0ArKJSzBqY95OvxrHQEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=725&vt=11&dtpt=398&dett=3&cstd=317&cisv=r20211207.59083&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 logic.js Show response
s0.2mdn.net/sadbundle/15574832698217520406/ Frame 5518 46 KB
6 KB 54ms
54ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15574832698217520406/logic.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d595bf80d4a40303bc1af6fe465bee63cce0294a4e31bd2df70e6663d500168

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 15:41:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6265
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 15:37:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Dec 2022 15:41:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/15574832698217520406/ Frame 5518 1 KB
427 B 60ms
60ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15574832698217520406/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5bf15ba20b2a1f91c3db8abe146ec55efa36a79fa91926383d943d7f9a3d61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 11 Dec 2021 14:48:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 487498
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 398
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 15:37:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Dec 2022 14:48:13 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 120ms
119ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21Uqs,pingTime:1,time:1430,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:105,t:409%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:1430,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1032~100%5D,as:%5B1032~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:414,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17.886082-58856297,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 119ms
118ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21Uqt,pingTime:1,time:1431,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:105,t:409%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:1431,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1033~100%5D,as:%5B1033~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:414,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17.886082-58856297,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 0120 6 KB
4 KB 71ms
71ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

438f8314af39b57c684ebfaf96c659e67eabfe444f783e1838e6daa37387d9f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4431
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1428 0
23 B 98ms
82ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst3ctwRgfwDTahZ2CjjBPx3ls7IKv7mZnuikYdZtqxj-JUauzXwKCBruhgK0FsFM_V4a8GYV1RyCBFg12RI5xRG2PGyn-W0A9GVicRSxGKjo1dBZEPHGBCkiUlLqxxfEjuPGdf0T4S5vtNyR0pb_9C1&sig=Cg0ArKJSzLsO3z6UFy36EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=932&vt=11&dtpt=431&dett=3&cstd=498&cisv=r20211207.27872&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1428 0
0 95ms
95ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvW9sSY8U9WK_U_IJigqKmA36-m28WeQQX-AkleIwSHeJPLlHRZR_4Za9WMrT_y3cAicTZJ8MCYqO9UE7-IAtc-dtOGdb2FdSGmiJAs7uXJdXhUt69_lpeaB6mq-Arp_1QO4tpxZijQ0oeF8dSWrtV8sH6l_PomHRwW5pBItAiXAyTbwadfcuhct6OulBZfdFI0T8MdgEcP0ObnHGkXzC3NQAmRKmo-iDLlykeB2gEuVi_DmOmd2FeNpYhCOyzhvAAfECCgppPYA_Z5V_odgMsUgyDb60LWknaunxjkx4MYsKVR-Rxhh8krAyswNL2mtj8I6Bf36KOeYRa-ujIN_wASgkWyYgo&sai=AMfl-YSgu3mWQy48gZo05uIp4If9DKlTHQy34aXGzn4W3R3ZXkpkPe7Xdc9e3ZRAxw_vHsVUHOe7zKpey1EukkeP5pzI6eNpFIz9VS2dQXazWsxKfPqPteTlbNVjXW4zivTk&sig=Cg0ArKJSzGt-JG2Xb1CFEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 logic.js Show response
s0.2mdn.net/sadbundle/3214996305205785738/ Frame 0120 44 KB
6 KB 58ms
58ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3214996305205785738/logic.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8946b38f0765342be5232ccc8f334f30fafb83cac439e63ccb304d7e0822697c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 11 Dec 2021 17:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 479583
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6140
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 15:37:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Dec 2022 17:00:08 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/3214996305205785738/ Frame 0120 1 KB
426 B 60ms
60ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3214996305205785738/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb7a6c72cacc17baf831179325155dff86bb6f2d7b2213941b1efa37dd99f28d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 12 Dec 2021 14:58:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 400492
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 397
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 15:37:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Dec 2022 14:58:19 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 53ms
53ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=1597&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1091&an=41&gi=1&gf=1091&gg=41&ix=1091&ic=1091&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1091&bx=41&ci=1091&jz=927&dj=1&aa=0&ad=971&cn=0&gk=971&gl=0&ik=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=927&cd=82&ah=927&am=82&xd=00&rf=0&re=1&ft=971&fv=0&fw=971&wb=1&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=689560233&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 61ms
61ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=927&tet=1091&fi=1&apd=1132&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5029899480&L2id=2942419878&L3id=5840893800&L4id=138375198146&S1id=22308610192&S2id=22654085702&ord=1639721589820&r=323435141851&t=iv&os=1&fi2=0&div1=1&ait=971&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad-plus-leader%3FT-1000&moatClientSlicer3=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 23445842_20200928073511123_SamsungSharpSans-Bold.woff2
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 58 KB
58 KB 58ms
57ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20200928073511123_SamsungSharpSans-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d43d6d5587c016e456942f68b150c1a72efc8eed796e35d787e151fd4ec712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 11:34:42 GMT
x-content-type-options: nosniff
age: 67109
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59680
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 14:35:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 11:34:42 GMT

GET
H3 200 23445842_20200928073420258_SamsungOne-500C_v1.0.woff2
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 205 KB
205 KB 124ms
124ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20200928073420258_SamsungOne-500C_v1.0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98f493a747651834b7c3caa317b74784bb1cad25baab6efc08855916966763bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 10:28:09 GMT
x-content-type-options: nosniff
age: 71102
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 209904
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 14:34:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 10:28:09 GMT

GET
H3 200 23445842_20190723072932267_loader-black-300x250.gif
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 21 KB
21 KB 438ms
437ms Image
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20190723072932267_loader-black-300x250.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aafe55a3dec6e92a774f4ae6be2a94d3a54cc65ceb20a2aced35d4c0ba3298f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 22:06:17 GMT
x-content-type-options: nosniff
age: 29214
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21227
x-xss-protection: 0
last-modified: Tue, 23 Jul 2019 14:29:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 22:06:17 GMT

GET
H3 200 23445842_20211129043715521_Logo_300x250.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 3 KB
3 KB 452ms
451ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211129043715521_Logo_300x250.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e61f6725ce75d4a56b4987ed661f31172a570176906d5453ab7417af5af1bbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 10:39:01 GMT
x-content-type-options: nosniff
age: 70450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2861
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 12:37:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 10:39:01 GMT

GET
H3 200 23445842_20211129040414019_CTA_1.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 3 KB
3 KB 450ms
449ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211129040414019_CTA_1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a1975dcc9ad3f6554724e6b245ad5a292b93f7e5b7b42de892d0bcdb0a60029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 10:27:30 GMT
x-content-type-options: nosniff
age: 71141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2773
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 12:04:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 10:27:30 GMT

GET
H3 200 23445842_20211129040417422_CTA_2.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 3 KB
3 KB 452ms
451ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211129040417422_CTA_2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9acced741605b55b0b0b87337835c5373371b75a7e8c55c0908cae4e00613699

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 10:27:30 GMT
x-content-type-options: nosniff
age: 71141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2629
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 12:04:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 10:27:30 GMT

GET
H3 200 23445842_20181126095148137_blank_pixel.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 930 B
956 B 452ms
451ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20181126095148137_blank_pixel.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89b324f54d51bb39e8687553c36ad08ad406be6fe1af9190d358e03231381c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:31:05 GMT
x-content-type-options: nosniff
age: 34926
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 930
x-xss-protection: 0
last-modified: Mon, 26 Nov 2018 17:51:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 20:31:05 GMT

GET
H3 200 23445842_20211202074050174_300x250_Offer_14.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 5518 70 KB
70 KB 454ms
454ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211202074050174_300x250_Offer_14.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1637e47191a0a5a43a90fede4af68ecd3298ae0a9d22ab3ae32feae27d7f4142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15574832698217520406/index.html?e=69&leftOffset=0&topOffset=0&c=sJdVmUgpj8&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 11:07:34 GMT
x-content-type-options: nosniff
age: 68737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 71468
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 15:40:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 11:07:34 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 0120 17 KB
6 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 95ms
94ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2021120601&jk=4411792276628597&bg=!RkWlRQHNAAZKWFskSlg7ACkAdvg8Wh2o5c-9tfgvn8Qzuk589JG_Jr_DfgGCX_BxcAbowHWL0QZ8tAIAAACAUgAAAAloAQeZAtbWYn5R0mqjDyFklZGkedcLuphfoSRlb_nS1oLUV1w58p2xuyAq-K6RwGISJgYFttzYYa_Aoy7TkspgQPyXMMmWuwUG61t7c__rSiLyn-s6WPVKP4-lDdNttWe7WCpsXTLBbOIpehrtf95Ud052ZEmBEkIy6IUUCf0wbRq7n7Aaij_VrWY3cuz9Ka8pM-7WUp4GKgR4r-l02n4fAn7vdSrhZsIhacCuyntbsiECDixVkHscaXNDDxCs77kCh2sJ6H0fGinESmKG2a4hjWhn9vZ6-OJ2nluskeliXhzHrOrVu0vkaz6lqcluTlxBNaRmc1iMq5xXnNdMRtQib16M-YLQX4snjSqanWzDd1FL6gWRgYUFjAeJqGZ_mruDz6tBVf0d-bi04Ywt9nh1c4ioiuwN_0IRhoTKbqYQo4FTF3bDHckfx6NqTaU6h633ZD5kDmodcaSmOKhuUNbkwF-CoEMhegAUYRy47SJDE5R2A2u5rWhzJreoBepKAhyTcC3QgJDmqPpcY6EWq4i4j23bMCs_RUtGdMd8Wx8GNMh1OupFletzP-NpPAxnDEfCeNtfXzdrrc4zJIbx-Mhcbvn-wzcWozWFAHrit3qiwQeQnG3Vyg-Nt2fpf5aJxRcVfqkqVlGe3TktnXUkNLTOTW0C7CwjDLF8wVudzCgX-HZMoGpJTTnfnwGLwBY-4kd_zNXtBNfBQ5vUkpZNcft9__UL49TSZFUxtr-uWXAQr_ZGVQvosIBHYM5ag77a9RnunzXpPtkoz7HXKUWOedWW4PKKaCGXTXnFr9iYvHn4P0fC8WrdwXqohbDwa-WNVChZNo4z-qjQd0iiPNvdIdgesA1EW0kufC1EthtRlwuKkPekst-aPcEY794y8bHlpYzACJFEYy0IaFDDP_UwX33NesSWnOuV2mxkTPRE89M1KFKsxw9vTiVLn1Fsq91wmcRJmyqkuGbFHWZrkqY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 23445842_20181126095148137_blank_pixel.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 930 B
956 B 448ms
447ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20181126095148137_blank_pixel.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3214996305205785738/logic.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89b324f54d51bb39e8687553c36ad08ad406be6fe1af9190d358e03231381c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:31:05 GMT
x-content-type-options: nosniff
age: 34926
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 930
x-xss-protection: 0
last-modified: Mon, 26 Nov 2018 17:51:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 20:31:05 GMT

GET
H3 200 23445842_20200928073511123_SamsungSharpSans-Bold.woff2
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 58 KB
58 KB 85ms
84ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20200928073511123_SamsungSharpSans-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d43d6d5587c016e456942f68b150c1a72efc8eed796e35d787e151fd4ec712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 11:34:42 GMT
x-content-type-options: nosniff
age: 67109
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59680
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 14:35:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 11:34:42 GMT

GET
H3 200 23445842_20200928073354787_SamsungOne-400C_v1.0.woff2
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 198 KB
198 KB 96ms
96ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20200928073354787_SamsungOne-400C_v1.0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3cde02566e9876b3c08d5086f431fdc35e708c1b46f5b24ff9bcff5f3804485c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:49:29 GMT
x-content-type-options: nosniff
age: 62622
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202580
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 14:33:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 12:49:29 GMT

GET
H3 200 23445842_20190723072937268_loader-black-300x600.gif
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 31 KB
31 KB 441ms
440ms Image
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20190723072937268_loader-black-300x600.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a415b0c5348f78e20e805935c2b02905cd53380802af0f55d258fc8dd6e20e52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:23:27 GMT
x-content-type-options: nosniff
age: 64184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32205
x-xss-protection: 0
last-modified: Tue, 23 Jul 2019 14:29:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 12:23:27 GMT

GET
H3 200 23445842_20211117061439204_300x600_Logo.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 3 KB
3 KB 452ms
451ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211117061439204_300x600_Logo.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be94b21bceb00e4f050fe4f3901e46a2b5b2a5a144c33d43c0025de5b1d03a1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 06:18:40 GMT
x-content-type-options: nosniff
age: 86071
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2990
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:14:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 06:18:40 GMT

GET
H3 200 23445842_20211124022505535_300x600_Add_img_Currys.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 10 KB
10 KB 453ms
452ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211124022505535_300x600_Add_img_Currys.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c295119f6d6a21fedc2134a2dffb0ebf36622295249c4d1daf40e360bf2ab31a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:53:01 GMT
x-content-type-options: nosniff
age: 62410
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10155
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:25:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Dec 2021 12:53:01 GMT

GET
H3 200 23445842_20211117061344292_300x600_Anim.png
s0.2mdn.net/ads/richmedia/studio/23445842/ Frame 0120 644 KB
644 KB 459ms
458ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23445842/23445842_20211117061344292_300x600_Anim.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99e3cf57d5cc44fd4d1c5a2afe4ce890490a6867609856845d831d1b97dda68c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3214996305205785738/index.html?e=69&leftOffset=0&topOffset=0&c=h30a3eyS4X&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 04:30:54 GMT
x-content-type-options: nosniff
age: 6137
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 659312
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:13:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Dec 2021 04:30:54 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 50ms
50ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=1598&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1091&an=1091&gi=1&gf=1091&gg=1091&ix=1091&ic=1091&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1091&bx=1091&ci=1091&jz=927&dj=1&aa=0&ad=971&cn=971&gk=971&gl=971&ik=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=927&cd=927&ah=927&am=927&xd=00&rf=0&re=1&ft=971&fv=971&fw=971&wb=1&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1311506121&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
redventuresgamdisplay60805146916.s.moatpixel.com/ 43 B
260 B 58ms
57ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=825&tet=1024&fi=1&apd=1026&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5026379933&L2id=2945788752&L3id=5848202531&L4id=138373623368&S1id=22308610192&S2id=22654085702&ord=1639721590483&r=850542442564&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 56ms
55ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=1599&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1091&an=1091&gi=1&gf=1091&gg=1091&ix=1091&ic=1091&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1091&bx=1091&ci=1091&jz=927&dj=1&aa=0&ad=971&cn=971&gk=971&gl=971&ik=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=927&cd=927&ah=927&am=927&xd=00&rf=0&re=1&ft=971&fv=971&fw=971&wb=1&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1718492693&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame A323 35 KB
13 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:53:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 20:53:34 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 129ms
128ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21UtW,pingTime:-10,time:1646,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuOTMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1639721590689%7C%7C8dd4685289963238dd10aab6725039ac%7C%7Ca2fdad25d911a8a4b39828759d282361%7C%7Cc48c1659b192c6836cf5e69cf88de3fa%7C%7C6f26d4a8d9bc48fb949a895156a653df%7C%7C997a759e5943bbcde271433b20107645%7C%7Ca1116cdf933c339f53322b9da785b20f%7C%7Cd0e1d2f286021c4d69885a47bfa877b7%7C%7C1629390669,sca:%7Bspg:9c50e3b6-23e7-b7d6-6281-0b964dc67322%7D%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt38.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 57ms
57ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=1032&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1024&an=2&gi=1&gf=1024&gg=2&ix=1024&ic=1024&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1024&bx=2&ci=1024&jz=825&dj=1&aa=0&ad=920&cn=0&gk=920&gl=0&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=825&cd=4&ah=825&am=4&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=195400504&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 121ms
120ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Uuj,pingTime:1,time:1135,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:1136,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1020~100%5D,as:%5B1020~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:102,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 119ms
119ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Uuk,pingTime:1,time:1136,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:1136,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1020~100%5D,as:%5B1020~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:102,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 121ms
121ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Uul,pingTime:1,time:1137,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:1137,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1021~100%5D,as:%5B1021~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:102,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:publ1,cmr:t%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:11 GMT
X-Server-Name: dt46.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 5518 17 KB
6 KB 81ms
81ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 55ms
55ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=1033&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1024&an=1024&gi=1&gf=1024&gg=1024&ix=1024&ic=1024&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1024&bx=1024&ci=1024&jz=825&dj=1&aa=0&ad=920&cn=920&gk=920&gl=920&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=825&cd=825&ah=825&am=825&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=2112898950&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 56ms
56ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=1034&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1024&an=1024&gi=1&gf=1024&gg=1024&ix=1024&ic=1024&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1024&bx=1024&ci=1024&jz=825&dj=1&aa=0&ad=920&cn=920&gk=920&gl=920&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=825&cd=825&ah=825&am=825&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1101139846&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 57ms
56ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=1819&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1312&an=1091&gi=1&gf=1312&gg=1091&ix=1312&ic=1312&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1312&bx=1091&ci=1091&jz=927&dj=1&aa=1&ad=1192&cn=971&gn=1&gk=1192&gl=971&ik=1192&co=1192&cp=1132&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1132&cd=927&ah=1132&am=927&xd=00&rf=0&re=1&ft=1192&fv=971&fw=971&wb=1&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1149296694&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame 9B5F 35 KB
13 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 20:53:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 20:53:34 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 59ms
59ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=1239&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=1230&an=1024&gi=1&gf=1230&gg=1024&ix=1230&ic=1230&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1230&bx=1024&ci=1024&jz=825&dj=1&aa=1&ad=1126&cn=920&gn=1&gk=1126&gl=920&ik=1126&co=1126&cp=1026&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1026&cd=825&ah=1026&am=825&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1099919740&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:11 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:11 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=1824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 133ms
132ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=1824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_1:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:11 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1428 42 B
64 B 50ms
49ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssl7Y4Mzlc9Mno8C_tVvzBWZKvMoO6wWvpMOGdoFVJwv2fSVgrd9Bmqoj50AZ0UxcKaVmIaxPy_lSxtlmuVVpjx1QHbtAhVqaI&sig=Cg0ArKJSzDnkdc_V86a6EAE&id=lidar2&mcvt=1002&p=0,0,600,300&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=34&adk=1575238846&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639721590031&rpt=959&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1428 42 B
64 B 62ms
61ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsupItMbNAcrYWgXyHYJIyDvLn8an_pYU-1ey1u2cpfxkgnW1Mo9ezthGoyMylEgqcWhvUlLDDV7OwLrYxqHQR5_OYRemrZwJ9UHFax-QnpnrKAseP6pdDL0Cl_i-bhvveiV-ZUnz99D47mHQ8Wg3nIvDz7M_ZBr-FShp9XJuCfdI_MaDDkAxhSWWx_1gmoGUgp96w&sai=AMfl-YRsLslwcrmgqGpNJAComDmo9cK7k-8YFisd6yv0QJCNQUvgIduOE7xrAXFJprZLy_pNKMRygCLbQVmSgvKVB97tQW6Bu76q8C0vQLd8PrYc9J5YO1vXVNYUiDX-q0Wk&sig=Cg0ArKJSzJTb1OrSSPk3EAE&id=lidar2&mcvt=1000&p=456,1050,1056,1350&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1139850431&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639721590031&rpt=1364&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 zdnet+9ace91bb-15e2-4b5f-90dc-a721785f2af9.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 3 MB
3 MB 5242ms
5241ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9ace91bb-15e2-4b5f-90dc-a721785f2af9.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: ee4fc478db1bf8c0b0746a3a07cef506a0b51d5db65d5b0aab3a1dbe1610dedd

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:13 GMT
via: 1.1 varnish, 1.1 varnish
age: 430
x-guploader-uploadid: ADPycdunrJNoC-SMTDBMlQ6DKGPo7Sks08xy1zA4Vp-wsdWLXPNH49WM20x83JDU4XIlRR6bR2SlHEi3aQJiG7VQoaQsTqOO-w
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 3334969
x-served-by: cache-chi21177-CHI, cache-mxp6977-MXP
last-modified: Tue, 21 Sep 2021 12:15:16 GMT
server: UploadServer
x-timer: S1639721593.969065,VS0,VE1004
etag: "8cb626914b1b2008f701245e62b97271"
x-goog-hash: crc32c=AF6arw==, md5=jLYmkUsbIAj3ASReYrlycQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:06:04 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=3324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 114ms
114ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=3324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_2:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:13 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 zdnet+40984316-75d4-4890-a717-84a4ec3a088a.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 3597ms
3597ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+40984316-75d4-4890-a717-84a4ec3a088a.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 753c21d87b2659d7ba709cf0b4b8824aeabe2405359821565daca11041b484bb

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:13 GMT
via: 1.1 varnish, 1.1 varnish
age: 676
x-guploader-uploadid: ADPycdsHadYqN4Yqk98OcHKUnWENCj1ktooKeFHxboOaehOHPg43KEvTTvMySvpIGlr8Sc8nGUwULhsbDigOZO7jKusTZJEeTQ
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 1164965
x-served-by: cache-chi21178-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 19:58:18 GMT
server: UploadServer
x-timer: S1639721593.453393,VS0,VE0
etag: "09b9e61e214d49899600a60821de1fd6"
x-goog-hash: crc32c=FMrjMQ==, md5=CbnmHiFNSYmWAKYIId4f1g==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:01:58 GMT

GET
H2 200 zdnet+ed6b06a8-ae34-44b7-8700-b414434c2c8f.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 580 KB
580 KB 4157ms
4157ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+ed6b06a8-ae34-44b7-8700-b414434c2c8f.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 8ec9903b7dde91f7df4e256ecf77954228889888eb116a8843bea4d090a53a0c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:13 GMT
via: 1.1 varnish, 1.1 varnish
age: 656
x-guploader-uploadid: ADPycdtKTw_E5Dc-X59bfnjA63K4IYWt4BwCsxUiKSDBH5w5aHkMVYcIuGUz3ND3NbfQpsBJ-_pawIzjDIc9j56fNrskny2uhg
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 593747
x-served-by: cache-chi21129-CHI, cache-mxp6977-MXP
last-modified: Mon, 06 Dec 2021 22:08:15 GMT
server: UploadServer
x-timer: S1639721594.750957,VS0,VE136
etag: "61fcb1edc59954a28fc2e14cf6d715cd"
x-goog-hash: crc32c=iVnpeQ==, md5=Yfyx7cWZVKKPwuFM9tcVzQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:02:18 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=4024/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 120ms
119ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=4024/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_2p5:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:14 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 zdnet+9d722c2f-a001-4a65-beb1-9f292209da11.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 2 MB
2 MB 5689ms
5688ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+9d722c2f-a001-4a65-beb1-9f292209da11.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: b8960dd4b158cad2e4e7b8317f26b7d36c528fa7301adaed4968d77dca548530

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:15 GMT
via: 1.1 varnish, 1.1 varnish
age: 850
x-guploader-uploadid: ADPycduQj9iU9haGxY6d5OR636T0wsrTtsWuTY-VDP6igTeNXNL8YpWsDbjMzuJnwtV-rIihh7vC6m2O7NPT_aoV_ZKtb6UR6A
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 1643499
x-served-by: cache-chi21173-CHI, cache-mxp6977-MXP
last-modified: Sat, 04 Dec 2021 01:03:20 GMT
server: UploadServer
x-timer: S1639721595.653032,VS0,VE568
etag: "04117e42706c353e6644c8238c5fcd55"
x-goog-hash: crc32c=HURRCQ==, md5=BBF+QnBsNT5mRMgjjF/NVQ==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 05:59:04 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=4824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 115ms
114ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=4824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_3:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:14 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 zdnet+7da68c3c-ce8c-4754-bfe3-ad5a3957a1ca.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 954 KB
955 KB 5074ms
5073ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+7da68c3c-ce8c-4754-bfe3-ad5a3957a1ca.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 2f895ea849b9abb8aa3e6541b7e94e6ac460e643d50aa9c709f877a0a0a3e465

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:15 GMT
via: 1.1 varnish, 1.1 varnish
age: 556
x-guploader-uploadid: ADPycdtQhel_lTd2y3ULVU9Ory8vTv9fv8xd0GIf7FnA0YHKw2qqx5rNcIwps0tDGasVO9eBiRzkbFLTGTJIYlkqPRY7UDpxuw
x-cache: HIT, MISS
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 0
content-length: 977315
x-served-by: cache-chi21126-CHI, cache-mxp6977-MXP
last-modified: Tue, 07 Dec 2021 19:38:14 GMT
server: UploadServer
x-timer: S1639721595.971221,VS0,VE197
etag: "1d1e2be75d6b59622adadb6f7487d874"
x-goog-hash: crc32c=46cmLA==, md5=HR4r511rWWIq2ttvdIfYdA==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:03:59 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 99ms
98ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21VsY,pingTime:5,time:5430,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:105,t:409%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:5430,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5032~100%5D,as:%5B5032~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:131,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17.886082-58856297,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:15 GMT
X-Server-Name: dt46.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 98ms
98ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=903347&asId=88347e9b-c11f-6ae6-f5fe-e510ce5f9e41&tv=%7Bc:x21VsZ,pingTime:5,time:5431,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:105,t:409%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:5431,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:409,wc:0.0.1600.1200,ac:0.0.1600.105,am:i,cc:0.0.1600.105,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5033~100%5D,as:%5B5033~1600.105%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:131,fm:sRPqGCe+11%7C12%7C13%7C14%7C15*.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C16.902252-59081166%7C161%7C162%7C17.886082-58856297,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:15 GMT
X-Server-Name: dt41.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
36ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=5684&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=5177&an=1312&gi=1&gf=5177&gg=1312&ix=5177&ic=5177&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5177&bx=1312&ci=1091&jz=927&dj=1&aa=1&ad=5057&cn=1192&gn=1&gk=5057&gl=1192&ik=5057&co=1192&cp=1132&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5017&cd=1132&ah=5017&am=1132&xd=00&rf=0&re=1&ft=4957&fv=1192&fw=971&wb=2&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=373903588&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:15 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:15 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
37ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=5061&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=5053&an=1230&gi=1&gf=5053&gg=1230&ix=5053&ic=5053&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=5053&bx=1230&ci=1024&jz=825&dj=1&aa=1&ad=4949&cn=1126&gn=1&gk=4949&gl=1126&ik=4949&co=1126&cp=1026&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4854&cd=1026&ah=4854&am=1026&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1010853158&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:15 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:15 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 98ms
98ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21VwQ,pingTime:5,time:5136,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:5136,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5020~100%5D,as:%5B5020~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:125,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:15 GMT
X-Server-Name: dt46.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 99ms
99ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=886082&asId=e1259329-2c1e-d99b-76da-fbc6ea1f81f4&tv=%7Bc:x21Vys,pingTime:5,time:5236,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:300,h:600,t:121%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:5236,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:121,wc:0.0.1600.1200,ac:1050.456.300.600,am:i,cc:1050.456.300.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5120~100%5D,as:%5B5120~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:125,fm:sRPqGCe+11%7C12%7C13%7C14%7C15.903347-59128492%7C151%7C152%7C153%7C154%7C155%7C156%7C157%7C16.902252-59081166%7C161%7C162%7C163%7C17*.886082-58856297,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Dec 2021 06:13:15 GMT
X-Server-Name: dt46.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
36ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=5886&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=5379&an=5177&gi=1&gf=5379&gg=5177&ix=5379&ic=5379&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5379&bx=5177&ci=1091&jz=927&dj=1&aa=1&ad=5259&cn=5057&gn=1&gk=5259&gl=5057&ik=5259&co=1192&cp=1132&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5218&cd=5017&ah=5218&am=5017&xd=00&rf=0&re=1&ft=4957&fv=4957&fw=971&wb=2&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1758120209&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:15 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:15 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame B0E2 43 B
260 B 36ms
36ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=1&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-Z%2Bh7GydOacklaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-4MFnRoeeeVpMDA%3D%3D&sc=1&os=1-IA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=128&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=84&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&cu=1639721589848&m=5859&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=128&le=1&lf=89&lg=1&lh=19&gm=1&io=1&fa=1&ch=0&vv=3&vw=0%3A3%3A0&vp=0&vx=-%3A0%3A-&pe=0%3A184%3A293%3A593%3A433&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5128&cd=33&ah=5128&am=33&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=84112121&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:15 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:15 GMT

GET
H2 200 zdnet+880e080a-7301-4a4b-a4e7-def615879cd5.png
media-mtml.mt.rvapps.io/image-assets/zdnet/ 1 MB
1 MB 5200ms
5200ms Image
image/png 2a04:4e42:4d::666
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media-mtml.mt.rvapps.io/image-assets/zdnet/zdnet+880e080a-7301-4a4b-a4e7-def615879cd5.png
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/a/fly/046431-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: a6d814cd452c142099d23b1952b1f8f30a2f6c26b5c544a6d4c941ad387087bf

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:15 GMT
via: 1.1 varnish, 1.1 varnish
age: 675
x-guploader-uploadid: ADPycdsG5sOVadJ5WYGR7IJh8LG6gag8pHMot2X_ZxosGmOfshs_yDy1LYMTxS20H00BHo6G5ERCde4EA6hGASrvauiC7q_pUA
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-cache-hits: 1, 1
content-length: 1333834
x-served-by: cache-chi21129-CHI, cache-mxp6977-MXP
last-modified: Thu, 12 Aug 2021 15:40:10 GMT
server: UploadServer
x-timer: S1639721596.943415,VS0,VE0
etag: "55fe6fa99fded7919ef98197501793e3"
x-goog-hash: crc32c=IPIV8Q==, md5=Vf5vqZ/e15Ge+YGXUBeT4w==
content-type: image/png
cache-control: private, max-age=0
accept-ranges: bytes
expires: Fri, 17 Dec 2021 06:02:02 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=6324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 115ms
114ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=6324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_4:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:16 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=7836/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 113ms
113ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=7836/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_5:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:17 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=9324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogres... Frame 957C 35 B
159 B 115ms
115ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=9324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_6:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:19 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

POST
H/1.1 200
OK NRBR-a22c617a7b2aab2da1c Show response
bam-cell.nr-data.net/events/1/ 24 B
501 B 138ms
138ms XHR
image/gif 162.247.243.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=12622&ck=1&ref=https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain

Response headers

Date: Fri, 17 Dec 2021 06:13:19 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 6bee013d0b7f8879-LHR
Content-Length: 24

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 57ms
57ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=105&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721589820&de=323435141851&cu=1639721589820&m=10707&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=69&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=10200&an=5379&gi=1&gf=10200&gg=5379&ix=10200&ic=10200&ez=1&ck=1091&kw=927&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10200&bx=5379&ci=1091&jz=927&dj=1&aa=1&ad=10080&cn=5259&gn=1&gk=10080&gl=5259&ik=10080&co=1192&cp=1132&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10040&cd=5218&ah=10040&am=5218&xd=00&rf=0&re=1&ft=4957&fv=4957&fw=971&wb=2&cl=0&at=0&d=5029899480%3A2942419878%3A5840893800%3A138375198146&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=5&zMoatH=5&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=nav-ad-plus-leader&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=nav-ad-plus-leader&hv=clipcentric&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=nav-ad-plus-leader&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1419680165&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:20 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:20 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
36ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-7qqaxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-ZEaFek%2FeXzptXQ%3D%3D&sc=1&os=1-9Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&pcode=redventuresgamheader644747280705&rx=373672897460&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&id=1&ii=4&f=0&j=&t=1639721590483&de=850542442564&cu=1639721590483&m=10085&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2747&le=1&lf=0&lg=1&lh=37&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1216%3A1216%3A2516%3A1207&as=1&ag=10077&an=5053&gi=1&gf=10077&gg=5053&ix=10077&ic=10077&ez=1&ck=1024&kw=825&aj=1&pg=100&pf=100&ib=1&cc=1&bw=10077&bx=5053&ci=1024&jz=825&dj=1&aa=1&ad=9973&cn=4949&gn=1&gk=9973&gl=4949&ik=9973&co=1126&cp=1026&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9878&cd=4854&ah=9878&am=4854&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5026379933%3A2945788752%3A5848202531%3A138373623368&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=mpu-plus-top&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=1617443263&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:20 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:20 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame B0E2 43 B
260 B 38ms
37ms Image
image/gif 92.123.125.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=1&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-Z%2Bh7GydOacklaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-4MFnRoeeeVpMDA%3D%3D&sc=1&os=1-IA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=128&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=84&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1639721589848&de=924275258455&cu=1639721589848&m=10882&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=128&le=1&lf=89&lg=1&lh=19&gm=1&io=1&fa=1&ch=0&vv=3&vw=0%3A3%3A0&vp=0&vx=-%3A0%3A-&pe=0%3A184%3A293%3A593%3A433&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10152&cd=5128&ah=10152&am=5128&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5822723755%3A138370913061&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=0&zMoatH=0&zMoatVGUID=4f317b9f-c636-495b-a0f5-574274c94874&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV=waiting&zMoatMMV_MAX=waiting&zMoatMGV=waiting&zMoatMSafety=waiting&zMoatMData=waiting&zMoatCURL=zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&iq=waiting&tt=waiting&tu=waiting&tp=waiting&tc=0&fs=195926&na=869603747&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.125.236 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-125-236.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:20 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 17 Dec 2021 06:13:20 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=10824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogre... Frame 957C 35 B
159 B 113ms
113ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=10824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_7:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:20 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 dc_oe=ChMI7N-695bq9AIVOeu7CB3KrgXvEAAYACCt84dCQhMIs9nx9pbq9AIVSvV3Ch2HDQIj;met=1;&timestamp=1639721601270;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame BA09 42 B
494 B 184ms
78ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7N-695bq9AIVOeu7CB3KrgXvEAAYACCt84dCQhMIs9nx9pbq9AIVSvV3Ch2HDQIj;met=1;&timestamp=1639721601270;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIv6ew95bq9AIVgk7lCh3HfgthEAAYACC284dC;met=1;&timestamp=1639721601384;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 1428 42 B
107 B 77ms
77ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIv6ew95bq9AIVgk7lCh3HfgthEAAYACC284dC;met=1;&timestamp=1639721601384;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Dec 2021 06:13:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=11524/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogre... Frame 957C 35 B
159 B 115ms
115ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=11524/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_7p5:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:21 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=12324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogre... Frame 957C 35 B
159 B 116ms
115ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=12324/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_8:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:22 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

GET
H2 200 video.high.mp4
tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=13824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogre... Frame 957C 35 B
159 B 119ms
119ms Image
image/gif 34.237.34.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.clipcentric.com/s/B=608/F=1317287/R=1317278/C=603283/P=22/L=21/V=23/S=kL7ZXeAW/Z=1/I=114.079022.1639721590056/U=www.zdnet.com/T=13824/M=i/D=d/PO=zdnet.com/LO=5840893800/VO=138375198146/E=vprogress_9:video%20auto/!https://clipcentric-a.akamaihd.net/video/F=1317287/V=ad_800x450_w1220_ch0/T=1638966209/S=ZR41Wf5d/video.high.mp4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.237.34.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-237-34-99.compute-1.amazonaws.com

Software

Apache/2.2.34 /

Resource Hash

6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 17 Dec 2021 06:13:23 GMT
cache-control: no-cache
server: Apache/2.2.34
content-length: 35
x-frame-options: SAMEORIGIN
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

38 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor	1970-01-19 23:30:03	Name: pv Value: 1
www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor	1969-12-31 23:59:59	Name: zdnet_ad Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22aw%22%2C%22subses%22%3A%226%22%2C%22session%22%3A%22b%22%7D
www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor	1969-12-31 23:59:59	Name: OptanonAlertBoxClosed Value: 0000-00-00T00:00:00.000Z
.zdnet.com/	1970-01-19 23:36:43	Name: nemo_highlander Value: seamless:1:c
.zdnet.com/	1970-01-19 23:38:46	Name: fly_geo Value: {"countryCode": "gb"}
.zdnet.com/	1970-01-19 23:38:46	Name: fly_device Value: desktop
.zdnet.com/	1969-12-31 23:59:59	Name: fly_preferred_edition Value: uk
.zdnet.com/	1969-12-31 23:59:59	Name: fly_default_edition Value: uk
www.zdnet.com/	1970-01-20 08:14:17	Name: _mfuuid_ Value: f072a2b3-abe1-41f5-a4c1-6b406eb4246f
.zdnet.com/	1970-01-20 00:11:53	Name: arrowImp Value: true
.zdnet.com/	1970-01-20 00:11:53	Name: arrowImpCnt Value: 1
.zdnet.com/	1969-12-31 23:59:59	Name: zdnetSessionStarted Value: true
.zdnet.com/	1970-01-20 00:11:53	Name: zdnetSessionCount Value: 1
.zdnet.com/	1970-01-20 08:14:17	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Fri+Dec+17+2021+06%3A13%3A09+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=77656e51-102e-463d-8f85-f8001a838794&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fsuspected-iranian-hackers-target-airline-with-new-backdoor%2F%23ftag%3Drssbaffb68&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.www.zdnet.com/	1970-01-20 16:59:53	Name: chsn_cnsnt Value: tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id%2Ctglr_hash_id
.www.zdnet.com/	1970-01-20 16:59:53	Name: tglr_tenant_id Value: src_1kYsAcdpfzbZ8UlNLYht1RPg3m2
.www.zdnet.com/	1970-01-19 23:28:43	Name: tglr_transit_id Value: fe885ebd-05c0-41a8-a4c7-a2574dbbbc35
.www.zdnet.com/	1970-01-19 23:28:43	Name: tglr_sess_id Value: 23c881e7-a543-4c7f-bb2a-383063da925d
.www.zdnet.com/	1970-01-20 16:59:53	Name: tglr_sess_count Value: 1
.www.zdnet.com/	1970-01-19 23:28:43	Name: tglr_req Value: https://www.zdnet.com/article/suspected-iranian-hackers-target-airline-with-new-backdoor/#ftag=rssbaffb68
.www.zdnet.com/	1970-01-20 16:59:53	Name: tglr_anon_id Value: 29bfbcc7-8c4e-4901-bfa9-015ed6defa73
.cohesionapps.com/	1970-01-20 16:59:53	Name: cohsn_xs_id Value: 603a6c73-a922-4f24-b21a-3ba0a283d886
.www.zdnet.com/	1970-01-20 16:59:53	Name: cohsn_xs_id Value: 603a6c73-a922-4f24-b21a-3ba0a283d886
www.zdnet.com/	1969-12-31 23:59:59	Name: viewGuid Value: 4f317b9f-c636-495b-a0f5-574274c94874
.zdnet.com/	1970-01-19 23:38:46	Name: RT Value: "z=1&dm=zdnet.com&si=930bcf57-e584-4a05-a6fb-85d8447496ad&ss=kx9zw9u3&sl=1&tt=1xw&bcn=%2F%2F02179910.akstat.io%2F&ld=24o"
.doubleclick.net/	1970-01-20 08:50:17	Name: IDE Value: AHWqTUm3Kng2CPlFIbuyVUMWVeHJCsxwpiTuHO3UP8i3lLC0AO74P0xo7Ai6MG1azd8
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 383734ff7a0a87ac
.www.zdnet.com/	1970-01-19 23:28:43	Name: tglr_ref Value: null
.zdnet.com/	1970-01-20 08:50:17	Name: __gads Value: ID=f5bee9e64fdf3e14-22cce1210acd0035:T=1639721589:S=ALNI_Mb2FMsD6xLNpKNuXT1foUyA1T_EVA
.casalemedia.com/	1970-01-20 08:14:17	Name: CMID Value: YbwqdlLjCgZe480XVyZzmgAA
.casalemedia.com/	1970-01-20 01:38:17	Name: CMPS Value: 697
.casalemedia.com/	1970-01-20 01:38:17	Name: CMPRO Value: 711
.casalemedia.com/	1970-01-19 23:30:07	Name: CMST Value: YbwqdmG8KnYA
.casalemedia.com/	1970-01-20 08:14:17	Name: CMRUM3 Value: 2d61bc2a762760CAESECQVrl8xGM9_vw7Lz8A-SKU
.adnxs.com/	1970-01-20 01:38:17	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Ilcomtg9!]tbPl1M>e)ZlrFUfJ+tGXxo<^iu_:[jrqw8fpU6PMK4#<WT/+_K@v#.-zXhbpRzqF1`b_O#'QB+
.adnxs.com/	1970-01-20 01:38:17	Name: uuid2 Value: 9053594510967034445
.demdex.net/	1970-01-20 03:47:53	Name: demdex Value: 45131864292705735731523214729770720927
.samsung.demdex.net/	1970-01-20 03:47:53	Name: samsung Value: 45131864292705735731523214729770720927

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js(Line 133) Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

02179910.akstat.io
a.myfidevs.io
ad.clipcentric.com
ad.doubleclick.net
ade.googlesyndication.com
adservice.google.co.uk
adservice.google.com
at.adtech.redventures.io
b6d73747d7c1733b5abfc5d740fa6611.safeframe.googlesyndication.com
bam-cell.nr-data.net
bid.g.doubleclick.net
c.go-mpulse.net
cdn.cohesionapps.com
cdn.cookielaw.org
clipcentric-a.akamaihd.net
cm.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
geo.moatads.com
geolocation.onetrust.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
ingest.make.rvapps.io
js-agent.newrelic.com
mb.moatads.com
media-mtml.mt.rvapps.io
pagead2.googlesyndication.com
pixel.adsafeprotected.com
px.moatads.com
redventuresgamdisplay60805146916.s.moatpixel.com
s0.2mdn.net
samsung.demdex.net
securepubads.g.doubleclick.net
static.adsafeprotected.com
static.myfinance.com
taggy.cohesionapps.com
tpc.googlesyndication.com
tr.clipcentric.com
urs.zdnet.com
www.google.com
www.googletagservices.com
www.myfinance.com
www.zdnet.com
z.moatads.com
104.244.36.20
142.250.181.226
142.250.185.162
142.250.185.66
142.250.185.98
142.250.186.70
142.250.27.157
151.101.130.137
151.101.194.154
151.101.65.194
162.247.243.147
184.72.183.173
2.16.107.33
2.18.235.40
2600:9000:225f:8e00:8:48e:53c0:93a1
2606:4700:10::6814:b844
2606:4700:3030::ac43:b431
2606:4700::6810:9440
2a00:1450:4001:809::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::2006
2a00:1450:4001:827::200a
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:831::2002
2a00:1450:400e:803::2002
2a00:1450:400e:80c::2003
2a00:1450:400e:80c::2004
2a02:26f0:6c00:1bb::11a6
2a02:26f0:6c00:2b9::11a6
2a04:4e42:4c::666
2a04:4e42:4d::666
3.222.76.241
34.120.203.121
34.224.146.121
34.237.34.99
37.252.173.22
52.31.222.185
52.48.241.99
54.171.82.61
54.229.132.88
65.9.64.109
65.9.64.94
92.123.125.236
92.123.125.44
00a1bc7a279775f2c97e02482771589bdd002cb9bd23ed0bd8c051d2fdc6621e
00b3b0b438a1a3e7f01112f487ffb01e64db47935eb0e1e2927bdb4811ee935f
022185811a029208da14948f296e29ce3ebb9aa90dfaf6a14570245e89a80165
06410b668985b047b6aa1c11723151eb469ec1e2d19f5134f843bcbbba2876ec
0672584c04dcfe018471290e9cd86a951af6801fd6b2f8449bb70d9f9995fb3d
06c00948dd5d4c3109c9e00bb6c44938e1251feae65e2b7c2591f333ab230d9b
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0aee86f10613d80ea0542d89047ea3467747db993379daeb592178ebf943b534
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0c2898711aa44688968b5769b7ca3a50be196c4897657ab6ce34f215b07f455d
0c570b511db41f5583cd77a9a03276c2041045d8ed4929b4f1bd98a5545d4492
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe
101c8b27f9bc4ef3e35779cdcc6cdf636fd4db74bca24fcb2ba1317c6baf151a
127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13631760fe58e5e9c2cf16890b9869a78629cb3769f552fb3b0eaf3fba8e934e
159153884138dfceca944de3cacf5b3c26bd6769af705b782ef4530de86b5906
1637e47191a0a5a43a90fede4af68ecd3298ae0a9d22ab3ae32feae27d7f4142
1a703d617fb31d56238372d5bf78e9861b3a09b7447a0184bd5f1c178461ed12
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
226d5c0c4002cd272342b9fe3647b28414eecef6bb2a38721d2630298cb91733
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
25d1232c03be7a132e5ae8165edb085f2ae958244ecbe73d3a4ae9b123fc3c01
261d96c1395d831efccac50b137c6f6eed71d8bb8a55d5489793a03b070a1a7b
27d43d6d5587c016e456942f68b150c1a72efc8eed796e35d787e151fd4ec712
295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0
29996f1588a8aa881f5ed1a207b098a9a8cfead8a41f785d528ca3417ea52fc3
2ac1b04d08bfbf760a3189bb92b657724f3d701ec3a2cd678e8997f953b643ae
2b526196d510bc11f40effba13f1b9e1792120b1f40b453695e8d7dcc05cf38d
2be99b99f418219be8ca7a986038e1a94c5df5b2c91a0c0d9ee35552fbb8fde8
2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675
2ea6cb8d44b18ddc26d8d83cbb898b780beeebe9d7529fceb1ac1824a397cff4
2f895ea849b9abb8aa3e6541b7e94e6ac460e643d50aa9c709f877a0a0a3e465
309c7f77b36ad8f0ecb6278afb0cf7bf91f525b2053ab757246a07e2879fe32d
329b801c09d8ddfe46296c0563753bffeb637b0f1c09146672adbbcec8f4a7c9
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
370b3675e73c3446505b967ae0bf66aaa6c05081961f818e6c493d39333689e6
3cde02566e9876b3c08d5086f431fdc35e708c1b46f5b24ff9bcff5f3804485c
3e279129e0b32c21501807eddb0c582841a0536e6dac62169361c51d5a9baed1
43327015c42ac1cbf9175f94b64efebb06ae71ad1d006e813d0292f37d987f9f
434e083f554789f0710b60942dd0845c4531b35735779a128c2601fe7ebb8ad3
438f8314af39b57c684ebfaf96c659e67eabfe444f783e1838e6daa37387d9f5
43b55e5e90420d26edbfb956f3f131888eb49e847a8b8b911ad9ae289665701a
43fdf898c76171d1b5af752978ebeb6ed248bc677d0b1dfb204b7ae95658cd99
4a1975dcc9ad3f6554724e6b245ad5a292b93f7e5b7b42de892d0bcdb0a60029
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c240d89b45c7946756fead01002bcf47bb154c99708fd92f2399941e89f6380
4d2a74d8b25e1ccd4b1294b0b937804bc24aeea7f46edad3f3c1f91604d2708c
4d53286fef493d463d74ff84299be6c2298e3b813bb52279c8c0049a0f23cd22
4f837b85045ca3fb8f7febcf4d79ee007f5103fd5175ca65f5d80fefda2bc9cf
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51d1fd2811538c38ef16dfaaeb4c7a4c3aaa71c30fba2bc6d3db6b0f5281924b
54ea2549eb776617398f110088f6752c767f249f7ec543d34353d3b390ccf634
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b6e97cf069d0d1a67390ad12ef50237963c77addfd1c8f15399b916993dd143
60cdd33bbc2dc12429ba1c6e704854dc9cc50feb06f9d05f606a54ad689990fb
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6351610f9cc19ebc631d437b6869af14eb71ae6f466d4901b2a841f49d6bdcff
63b5f5e75af64e4f7f37759cc56d6a427fe98443c9f6663cb8ec6a688e00596e
6b9db45c7b730f0490aec270afd438e929bdc824fb5e21ce44982453cc03a542
6c0cd7b80611259d4ccce9165e8b5dd062aad43e3e3e19a404fe967c49795d03
6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019
6c8875aacffbc34e495e1603faaaeb505ce6acbc77f1d17934ff78bae4544367
6d5246d5f81b078b8d850b3fbe4ac7c44d05c0755ea14786c6fee453e6805fff
6ea15d348d14879f357a86ee77c702c1f5c99db9bf8cd545b82b6e34f674b0a9
6f465f0d10ac14f650fde648357c60f9f7c1233c267a136208c4f3f0d35c205d
6f65966ea4df3c85a87ac07ca39074efdd91c50b2bd0d2d2ebc19da3964d3a2a
71250efca09863ab52eec2177b9b59be4d722eb5b47505b26ef2eb5c31437df9
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
72c20ec0159a5b3d9ba18d2a376bd6f955a9d045f782dedda0740e69c1523fde
753c21d87b2659d7ba709cf0b4b8824aeabe2405359821565daca11041b484bb
7a4c34b8b214e347836a070bad5395040344e037e289f77b11e9e49394ba0558
7b4f05cfd0cd8e216e445b5aec5e9f06573c18cb7adbc0cd785f3a4af3df7cf2
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf
80564ff963220266c89e284ae65634312da063d0ea5ee747527fd38e8c398d96
80da370ad41bee2716b42d1583e139eac39f5c7c243c5fe6439b9754013116c6
81bcd7a6372e5ca7f7d12382fe1787bd4635eede42b3a79da6937c6d2354ed8b
82f947d14a0a198dfe3cec2fde7896f6e332eb798cc193dad8da9ed2225277cd
83575e34525331ea577205e94ffcb89cb9bb5cbb6e9f1c852dacaf941276de5b
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
8884ad54b3b16ad4e66af3377c4b475899c1c70807bb0bc3eca9227a0b09444b
88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9
88d3ca80b7507885eececa9eb48c0d5c22c3d59487036dd4d9917cd65215335a
8946b38f0765342be5232ccc8f334f30fafb83cac439e63ccb304d7e0822697c
89b324f54d51bb39e8687553c36ad08ad406be6fe1af9190d358e03231381c9e
8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e
8ec9903b7dde91f7df4e256ecf77954228889888eb116a8843bea4d090a53a0c
9477b3d4cdd340041acf6104e04d49bb5d7a8c0bc08418f3f4c8f53f59948eab
95698b6af45a720fa13415398e77c20504c6ae8bf75e3a462e5aa1f67bc42b11
95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa
98f493a747651834b7c3caa317b74784bb1cad25baab6efc08855916966763bf
99e3cf57d5cc44fd4d1c5a2afe4ce890490a6867609856845d831d1b97dda68c
9acced741605b55b0b0b87337835c5373371b75a7e8c55c0908cae4e00613699
9b7909cb9edd007095b41a13617b66208e4210fff9c5e411a7db116efefc8e71
9bc70475a78cf6d052b023d9a5f720b76e74eb6446236912ed2df2d429ccf8b7
9d595bf80d4a40303bc1af6fe465bee63cce0294a4e31bd2df70e6663d500168
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd
a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee
a415b0c5348f78e20e805935c2b02905cd53380802af0f55d258fc8dd6e20e52
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a65474aec3d05036fdc95a4459d85f1543f464934698df8e4a9d1bca61a0500c
a6d814cd452c142099d23b1952b1f8f30a2f6c26b5c544a6d4c941ad387087bf
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
aafe55a3dec6e92a774f4ae6be2a94d3a54cc65ceb20a2aced35d4c0ba3298f8
ade4a225c8f67f6d546600cadf4eacaab9b038b30acf18312838eef9154e7296
afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b8960dd4b158cad2e4e7b8317f26b7d36c528fa7301adaed4968d77dca548530
ba5c9b5823ef1377da70e73357b85ef2dca7ade9afe70c93d0aa163c61c9bf03
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05
be94b21bceb00e4f050fe4f3901e46a2b5b2a5a144c33d43c0025de5b1d03a1f
c295119f6d6a21fedc2134a2dffb0ebf36622295249c4d1daf40e360bf2ab31a
c3b9597a90a43830b2a92897a5ef015ce5310e7f32dbb5cd1db2c807c5e6b036
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2
c6aba455f529f02dcb316748e648dab7f24e686165f69e2c42c00c6e68ac42b8
c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083
c98713a27c661e04f9aecf37a7794088451f73bab4b9bb615ed29ff5a5fd75e1
cb7a6c72cacc17baf831179325155dff86bb6f2d7b2213941b1efa37dd99f28d
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ccd7a7e0ecd791d87287f7ebb4f4c3e6fcb0ca72996ee874fc2755b15fb187ef
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d32763388ba6d9bba0619b8912021d30345002aa0d5dcba3ce01a05da23f72db
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e571945dec453fbc4c8177ad3af3f176dc562cf51fe40a10529b69e0b2b1e577
e5bf15ba20b2a1f91c3db8abe146ec55efa36a79fa91926383d943d7f9a3d61f
e61f6725ce75d4a56b4987ed661f31172a570176906d5453ab7417af5af1bbea
e9cac3eeba1fc86e06fdc013a4c52742e9b4bd14b7be6517321127d4515095ce
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604
ebce81fff4ecfa438572d849a07d740d774a7cd178d17ea371957cf079835ab0
ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c
ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07
ecac033e3265c5ffd57f0f6205cf879f5bc4fef2fc324b5604f0f89e6c174a1d
edbd713299a6a4e9fbb2ab92ba53e61a9bfcd3e05366bf760384c229907365f5
ee4fc478db1bf8c0b0746a3a07cef506a0b51d5db65d5b0aab3a1dbe1610dedd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8146ba1b2688b95d2b826cbd8c9474ea00775a9a8ced7763a6100c216ed932
efdfbc7761acd2e415ffb57be691b40856508557c56c10de55cd6827ff83c1c2
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0
f538679c8993e0baddbc2ea3f337621ff233da76626d3b80c5dec8d8164c7d0c
f6a1d1301a41d925a220c3cac7f9d927356bff1c809259b16601325663de156d
f74cbe6cebaeb5c2cbd346c9e6d61b3846a661248dbc17415d24286737fa3968
fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127
fbbbdd947c9901b0ecb0efdd93da5e83cc0a129f7ab01b2eae4b250808921c66
fc94bb20615ba7e788f5ce0c7b42cfcd5f7bf91c9bd0d24bc2c1ff4cc1984a4c
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

www.zdnet.com Open in urlscan Pro 2a04:4e42:4c::666 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

304 Requests

96 %HTTPS

41 %IPv6

29 Domains

49 Subdomains

47 IPs

4 Countries

26963 kBTransfer

32545 kBSize

38 Cookies

18 Outgoing links

Redirected requests

304 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zdnet.com Open in urlscan Pro
2a04:4e42:4c::666 Public Scan

Screenshot
Live screenshot

Full Image

304
Requests

96 %
HTTPS

41 %
IPv6

29
Domains

49
Subdomains

47
IPs

4
Countries

26963 kB
Transfer

32545 kB
Size

38
Cookies

304 HTTP transactions
13 data transactions