www.zdnet.com Open in urlscan Pro
2a04:4e42:1b::444 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Submission: On March 12 via api (March 12th 2020, 5:07:29 pm UTC) from US

Summary HTTP 210 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 25 IPs in 6 countries across 19 domains to perform 210 HTTP transactions. The main IP is 2a04:4e42:1b::444, located in Ascension Island and belongs to FASTLY, US. The main domain is www.zdnet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 24th 2020. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY)
20	2a04:4e42:3::444 2a04:4e42:3::444	54113 (FASTLY) (FASTLY)
6	152.195.132.202 152.195.132.202	15133 (EDGECAST) (EDGECAST)
3	2a02:26f0:6c0... 2a02:26f0:6c00:18c::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE)
56	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:81a::2001	15169 (GOOGLE) (GOOGLE)
1	151.101.114.110 151.101.114.110	54113 (FASTLY) (FASTLY)
1	2a02:26f0:6c0... 2a02:26f0:6c00:18b::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42:1b:... 2a04:4e42:1b::645	54113 (FASTLY) (FASTLY)
2	162.247.242.20 162.247.242.20	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
1	2a02:26f0:6c0... 2a02:26f0:6c00:19c::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	95.100.197.246 95.100.197.246	16625 (AKAMAI-AS) (AKAMAI-AS)
5	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
1	92.123.1.187 92.123.1.187	16625 (AKAMAI-AS) (AKAMAI-AS)
5	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
2	34.254.103.40 34.254.103.40	16509 (AMAZON-02) (AMAZON-02)
5	69.173.144.155 69.173.144.155	26667 (RUBICONPR...) (RUBICONPROJECT)
5	23.37.55.184 23.37.55.184	16625 (AKAMAI-AS) (AKAMAI-AS)
1	18.203.131.238 18.203.131.238	16509 (AMAZON-02) (AMAZON-02)
19	72.247.226.64 72.247.226.64	16625 (AKAMAI-AS) (AKAMAI-AS)
210	25

26 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY, US)

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a04:4e42:3::444 (Ascension Island)

ASN54113 (FASTLY, US)

zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
production-cmp.isgprivacy.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 152.195.132.202 (United States)

ASN15133 (EDGECAST, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:18c::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:81a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:18b::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

686eb51b.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::645 (Ascension Island)

ASN54113 (FASTLY, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.242.20 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-8.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:19c::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

684dd305.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 95.100.197.246 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-197-246.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.37.42.132 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

ads.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 92.123.1.187 (France)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-1-187.deploy.static.akamaitechnologies.com

rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

optimized-by.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.254.103.40 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-103-40.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.155 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

beacon-eu2.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.37.55.184 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-55-184.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.131.238 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com

s.update.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 72.247.226.64 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-226-64.deploy.static.akamaitechnologies.com

cbsdfp5832910442.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	636 KB
39	cbsistatic.com zdnet4.cbsistatic.com zdnet1.cbsistatic.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com	873 KB
22	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	207 KB
21	rubiconproject.com ads.rubiconproject.com optimized-by.rubiconproject.com beacon-eu2.rubiconproject.com eus.rubiconproject.com s.update.rubiconproject.com	53 KB
19	moatpixel.com cbsdfp5832910442.s.moatpixel.com	8 KB
17	googletagservices.com www.googletagservices.com	451 KB
11	moatads.com z.moatads.com geo.moatads.com	947 KB
7	google.com adservice.google.com	1 KB
7	zdnet.com www.zdnet.com urs.zdnet.com	197 KB
6	google.de adservice.google.de	1 KB
6	cookielaw.org cdn.cookielaw.org	128 KB
3	go-mpulse.net c.go-mpulse.net	49 KB
2	nr-data.net bam.nr-data.net	455 B
2	akstat.io 686eb51b.akstat.io 684dd305.akstat.io	708 B
2	cbsi.com production-cmp.isgprivacy.cbsi.com rev.cbsi.com	12 KB
1	cbsinteractive.com vidtech.cbsinteractive.com	281 KB
1	newrelic.com js-agent.newrelic.com	10 KB
1	google.be adservice.google.be	171 B
1	onetrust.com geolocation.onetrust.com	313 B
210	19

	Domain	Requested by
26	pagead2.googlesyndication.com	www.zdnet.com optimized-by.rubiconproject.com pagead2.googlesyndication.com securepubads.g.doubleclick.net
19	cbsdfp5832910442.s.moatpixel.com
17	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com pagead2.googlesyndication.com
16	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
16	securepubads.g.doubleclick.net	zdnet3.cbsistatic.com securepubads.g.doubleclick.net www.zdnet.com www.googletagservices.com
14	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
10	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
9	z.moatads.com	securepubads.g.doubleclick.net
9	zdnet1.cbsistatic.com	www.zdnet.com cdn.cookielaw.org zdnet2.cbsistatic.com zdnet3.cbsistatic.com
7	adservice.google.com	securepubads.g.doubleclick.net www.googletagservices.com pagead2.googlesyndication.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com
6	adservice.google.de	www.googletagservices.com pagead2.googlesyndication.com
6	zdnet2.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
6	cdn.cookielaw.org	www.zdnet.com cdn.cookielaw.org
6	www.zdnet.com	www.zdnet.com
5	eus.rubiconproject.com	www.zdnet.com
5	beacon-eu2.rubiconproject.com	www.zdnet.com
5	optimized-by.rubiconproject.com	ads.rubiconproject.com
5	ads.rubiconproject.com	www.zdnet.com
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net
2	geo.moatads.com	z.moatads.com
2	bam.nr-data.net	js-agent.newrelic.com www.zdnet.com
1	s.update.rubiconproject.com	www.zdnet.com
1	rev.cbsi.com	www.zdnet.com
1	684dd305.akstat.io	www.zdnet.com
1	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com
1	686eb51b.akstat.io	c.go-mpulse.net
1	js-agent.newrelic.com	www.zdnet.com
1	adservice.google.be	securepubads.g.doubleclick.net
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	production-cmp.isgprivacy.cbsi.com	www.zdnet.com
210	32

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
www.youtube.com
www.cnet.com
securelist.com
cbsi.force.com
www.cbsinteractive.com
www.facebook.com
twitter.com
www.linkedin.com
legalterms.cbsinteractive.com
narratives.zdnet.com
ca.privacy.cbs
cbsi.secure.force.com
academy.zdnet.com
privacy.cbs
onetrust.com

Subject Issuer	Validity	Valid
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2020-01-24` - `2021-06-18`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
sa437gl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-05-17` - `2020-08-19`	2 years	crt.sh
*.isgprivacy.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-10-07` - `2021-10-14`	2 years	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2018-03-12` - `2020-06-14`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
*.google.be GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-04-10` - `2020-03-21`	a year	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-02-13` - `2021-02-17`	2 years	crt.sh
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
kazfv.com Sectigo ECC Domain Validation Secure Server CA	`2019-06-05` - `2020-06-04`	a year	crt.sh

This page contains 29 frames:

Primary Page: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Frame ID: 3779FC3AEFDF2ECC66E6E04470087D2E
Requests: 98 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: CAB6739159F3783B5E4A693528BFFA34
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssdSfLAns5wHomlCZctmod03zTpLr1MntSypHxGP3AUBhmAk3eGWcn5bMiIkhbBtgINtTKmb7Zen3W0AfLxDvLI-D0FWeDKKg1817mt02pU8Hf5IXuXNSx2lPH_3bb15Uc8tLqk8viUlAPvBad7uEfKQhALU78n1DGme6ZC32tC_dx6EX9OcCR9dWaf15FFnOQXHZvu8I5U9WBieXOg-IPOK44OvicgZPQD_qKMmOWA9AOWspPL3Lu9uSqoiyvHLUWJlf_V1JPY&sai=AMfl-YTNjb6G41xPgMt4masHqqm8a5ZMbvxD7MwyZlwXhinCAt4yTR_HV8_4mASZZqV_xFmJMZII23dc-1RY_KPfJp7d685bcrg5ZezxNg_m&sig=Cg0ArKJSzF9a_hkAUSFnEAE&urlfix=1&adurl=
Frame ID: AA7640D14037D8A8A1AC0821FEE7AE07
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqoe6fQMrPI5CSqxkP4QIDUmRIF_S6DzyGsB-PqpjM1Vs7-XJWQ1s31EhoiOY-QjJgHQT0rGqMgiI_7nykw8gq26_QXmLjCsQbiURALNSxLr9Xtbq1RL7iJ5LVHilyGJgRpNShXqpK-f01vU-NRXb1y-jm_sLfEkgcAK9DDfUqU8zQDfuHeSX9i6DJyMvkJCqgOF0x9zcRIxU4F1EHuKYHu2sTXKF7zYwKkio_IRPtNLVMvGhoLKzF2FtXURRqDVub4NA&sai=AMfl-YQxuQaOx6mGYrTvybaZH0TR9NXGfw0lMSkB9a_J1ES8Yxc0YKOEIrMhoAgvJ5dDJuZ5mo-CnegOaQf6TlAqKmfYj-0UrI04vhOZiuAh&sig=Cg0ArKJSzNUIxZCUXDfgEAE&urlfix=1&adurl=
Frame ID: 26AA8ACD48375C7C7537AA2B6AA76806
Requests: 16 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsumpQkmSOpZQcQ9KWTdSooUYZYzFFbeH-4jbdsqtnBZiyMWP2dKiMLWLopLXodM1mmdJbWOKqiNEZMEpbjErWyiCoBg7mIWnHXKNUpHfqBEWmrjlDFLObU9sE_fyHJ_bGQN3JRYTdgPxcfDbF8U6PTugqrhheAfERRNqGnsOROxZIXId8JQGFC_wYZbHw5RNGlUX7LRghMm_PU0ER_XWcTxSgScW3o0vbM-jRx5vNxWHhILqu6gy1nRkNfFxsFvvvd_Bxo&sai=AMfl-YRGO4flY7_kcXbX8klWdnf0M7G1P46pvgntUhUUp6uJo9-j-hYL8JHx6-ODWKox8ktwgzW2JwwVAay65x4TpvrORcobzjy6K1UxL-ow&sig=Cg0ArKJSzLXPH2HPmqvwEAE&urlfix=1&adurl=
Frame ID: 33B98FD2DCD4B4A39DAFF9D8E032C77E
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstHstae6BZ_DWYlnfglet_QXZzsuTxs9G_cPV7sJt4QgcTrnG88ARkrWOP-b88Krsk8a9bTXMIaFNnaCqITwff2I_2BHBt6TGTq_bw8xkgObk0IDdB_c52dKL2NpqOZLGhFBwb7B6tO2n2eug5V19vhYnkLM6-0ugBYdbu30DpGqWnzc-u363RDnhvwtRhk9xF6tdXz88cGbpKBmSc_kk-LaLiOvY-ECd4cqWBeTMG4cxxuQpddFMg5xvbJlVsKBbBMZzY&sai=AMfl-YSOZ-6oc-PC_e9v54QH6jQoWoj8N8tkRw9gvJIdwv-Ewh4CI1DUO3QuWQeLvAi8_ned4P0qAlSGRmnYqnzvHzKRWJrL6x_Zls84adCa&sig=Cg0ArKJSzJAAWOChGq7QEAE&urlfix=1&adurl=
Frame ID: 917A9D4E88E0E42CCEEEC5F720777293
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJqd3VitnTrah09Z3ND44_QmnExNgJW00A1eDdlu0JwzeG4g_RYw1uf22luMOLqoUhDAHVJHmPDW52F8as3smTaeasEvlSKCH8Jy66QSRrIR5VXuW5uwad9zR-jAVaqNIYWtCdvIr676jtxbEWjDhYaBYIaOuhYtIawWv9JWcFtvVpXjiivIFsa0SQEyMx4H_0Lqy-IICJBrZrjlc0wYeX_04WwsCTrHw2zYR0zR8YqYIqFzKZ8kOIpZBwjggcAb94KVoG0x74&sai=AMfl-YSsYq_w9FTiDnuXSCDQFgSBBx07TVQsgam72qPjKf3y8TdGrg53h2J4iaCdHEmFtAbV37Uk2yK9_18WPFLC0uTOaIlffOwqJQUv0f9N&sig=Cg0ArKJSzLEnZ3143g77EAE&urlfix=1&adurl=
Frame ID: 2464A36B64B2425595C457CFCDDC2817
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstYFpAsKYr9aqCopnzZQhBzkDnk2nz22jMfUgE_eJF97KVCWReIWqRZ89xbjwb5KFXCQpyXTW4lxXGNG5cc_tVJtHh7pcillcXR10-mOitW5DDpWqmlJ7jmQ31fJI9V1wbpQXvVZrF8L-d8WWaHZdyZqghX62fAqXdwqnkl7ErOsPA6_HRHizuMhhn90EegvJJICDTXsdJraUipo2lCqxbrKofBVxvtGCsoQG3TQNTNv1CIhvMqTbsrnjReevtH_7Xq_b8&sai=AMfl-YSRtKxivHSwCeWdMW0GAy5_zlnRsATZbGejzhJ9FO0iBZ0oTfLhfIiZbkZPJCk0GRMRhFlr17Ifzz-ZlUsYvWduJMIzDVbCOO66zEE6&sig=Cg0ArKJSzIjNQE7-Kgp-EAE&urlfix=1&adurl=
Frame ID: D8E0DC6BF1D82C223AE6B2CB26A496C1
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZpVPNj6nvfvFvfWcKP853SWoK0fahf6aEZazZQI34H8AAc_f7dHPgRvwNAd_93yxBYgtwXV2TLSMW_mpPd6fNFg7Aa0DSS0G0nkSZ5auVHFhPO6Q7riQH-4Jtt717iabSxl_2jkNURMVNPRiPoUVCdpEIJR7E76lPLIbd0_rq7A7ZtwfTkBlRxy8XYV3OQCr6NXLM2ZMEzePpIsmR9XbZO6UPSbpj33SCKwxpvZBQ2lHnZhv8R0RT7uVXwkiCp8L4L7I&sai=AMfl-YQwMfb09XAypEb_9X0VIyXUD30RZ7GXuuYOIqRb3iZ_0px5yf2xXBxngAwv0LmRLo3f0xgwHrtyU5WDYh5cFF19Rowgxx8q3Q3eQj9G&sig=Cg0ArKJSzLezQ1r8SkOxEAE&urlfix=1&adurl=
Frame ID: 353C00ED05154DB84DAF2CA8E1AFCBD4
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: C9A4ED80FB24427DF05A45D8F93C6004
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200305/r20190131/zrt_lookup.html
Frame ID: 70060ABA20C54A2FB5BA29F3707995CC
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Frame ID: 4212E57BBEACD7A15384C11941C07096
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Frame ID: E92F1821C18B5D6C25452E4A87B5DF40
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Frame ID: E15413040B412BABE25334FD6389D3CB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu3DAyiePzFl7DQySEKuJtJwNE8480YmzNqL00_XhWDzv7IJdd37RE30eWKx1_z_zwbMA0nFv8cogq0zXCi9nm_2N2JVM1cSc67wV29CdYhAWeWADIa3zmPY4c8AgpKV9x60zkTAHOEtLjXsARPSQx3ZsTo-Wwi5MQ8rslLvNbhsXRTa82WC5decd6TjXJQZgRf0czBpdehIiDjt05-XSL0VFKY4Gr6slOZec5BTjdm_238HtKdImw4PfjnaxBZcchTX0pSRKWN&sai=AMfl-YSOKH8uHbJEV0i6FM_j2WtvOCMsTkKw3AwcgCxz-FNsP2MZsxVah6VCKOq_vSfZCcjMgr6CBWU8tXuzeB5YA34MhNJh0iuCNgKoG-ft&sig=Cg0ArKJSzOb8o9ep8IBrEAE&urlfix=1&adurl=
Frame ID: F19DB809E5A6146561F899B25561F8CF
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJExY22QEVwZMheYgB1Z_SsudmJQKgCs5-cdINI7-vvSIyIZsnyXp3qyvsc0oJVq2XMs7l_G9xxmLGxY_oSM1O43mYgUGPz9hrYwCD0LGhhGBFaJLdTN8QSf2NiXFFifQ7feOx-OKrMNOHCUWvIYfxSBBuPO2CiGOLBuNMy0zH0owCXsQnDidQ2Z1rmiM7iYsf9r5ecegp4JfPQsQInzQZXU4EIzk2XR8wBSq6o9auN33LjYRaHYVltS4SbGVbIhD5OHjk4T4G&sai=AMfl-YTaRdgdSO0sgwjvbd5ncOIHLRa5OBmeQffsV5ZFNcfEg6UfsoTP8ctJWKVnw0d0i1fbkispNzkfbhMrt-uTw-HfCs7Wotl899cjH0Jd&sig=Cg0ArKJSzCI3vMqGVH95EAE&urlfix=1&adurl=
Frame ID: AAA5274559A19632E8E83A881AC8EF49
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413279&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829203&bpp=16&bdt=385&fdt=167&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=2&ga_vid=1971072696.1584032829&ga_sid=1584032829&ga_hid=1999655024&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=333&biw=1585&bih=1200&isw=728&ish=90&ifk=1148202356&scr_x=0&scr_y=0&oid=3&pvsid=3618399251584500&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.erhiyxp5evyi&fsb=1&dtd=178
Frame ID: 5E7CFADE34F7C00F3B406FA0951B30D2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413248&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829258&bpp=5&bdt=434&fdt=177&idt=177&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1565623352.1584032829&ga_sid=1584032829&ga_hid=1636104168&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=20&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=453&biw=1585&bih=1200&isw=300&ish=250&ifk=886226891&scr_x=0&scr_y=0&eid=410075105&oid=3&pvsid=1122485607173891&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.nmg40majjc8v&fsb=1&dtd=181
Frame ID: 31D46909D133611F91A96FD8292360A5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413249&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829281&bpp=5&bdt=452&fdt=166&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=2078213747.1584032829&ga_sid=1584032829&ga_hid=1848545154&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1679&biw=1585&bih=1200&isw=300&ish=250&ifk=2777019739&scr_x=0&scr_y=0&oid=3&pvsid=2588318893433168&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q1vyt07be7v&btvi=1&fsb=1&dtd=171
Frame ID: 5FC0A62BB47873B7564DC6855451C2A5
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Frame ID: CF6B6632F94E76A09267F83DB4BEF3C2
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Frame ID: 9613AA143FA0857D950F97C137F76A3B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 47B34BBAFD202C11D154F5C0FDEBD2D4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413251&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829512&bpp=5&bdt=665&fdt=150&idt=150&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1664653436.1584032830&ga_sid=1584032830&ga_hid=1739500928&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2697&biw=1585&bih=1200&isw=300&ish=250&ifk=4189721277&scr_x=0&scr_y=0&eid=26835105&oid=3&pvsid=2796627451943604&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.hvkbm9d48e2k&btvi=1&fsb=1&dtd=156
Frame ID: DB6B231351E8DD70BF9932A6E474E426
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413252&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829550&bpp=5&bdt=697&fdt=130&idt=130&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1281712523.1584032830&ga_sid=1584032830&ga_hid=1655138103&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3657&biw=1585&bih=1200&isw=728&ish=90&ifk=1512305787&scr_x=0&scr_y=0&oid=3&pvsid=1333862255284750&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.lxqyvk9hhb7g&btvi=1&fsb=1&dtd=136
Frame ID: 92BC3C922825CDA3CCA86D6C3009C8E1
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 18BB59CDC6E07FBCD1D86D568DF6B025
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: CEE4F198964A3A4BB0615C814F87CFF5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: F9496763A3EEE22A5A68CB3EE5F43460
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 241FD04A8D7E53474C7083246284A17B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 2D68A7906DC99057013C8D79F80F0644
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

210
Requests

100 %
HTTPS

42 %
IPv6

19
Domains

32
Subdomains

25
IPs

6
Countries

3855 kB
Transfer

10960 kB
Size

12
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=91BDJPk4YIg
Title: How to protect yourself from mobile malware attacks (ZDNet YouTube)

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/best-home-security-systems-for-2020/?ftag=CMG-01-10aaa1b
Title: Best home security of 2020: Professional monitoring and DIY (CNET)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/how-to-setup-secure-credential-storage-for-docker/?ftag=CMG-01-10aaa1b
Title: How to set up secure credential storage for Docker (TechRepublic)

Search URL Search Domain Scan URL

URL: https://securelist.com/cookiethief/96332/
Title: dubbed Cookiethief

Search URL Search Domain Scan URL

URL: https://www.cnet.com/news/us-isnt-prepared-to-stop-cyberattacks-commission-finds/?ftag=CMG-01-10aaa1b
Title: US must do more to stop cyberattacks, bipartisan commission finds

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/biggest-trends-for-5g-as-infrastructure-to-hit-4-2-billion/?ftag=CMG-01-10aaa1b
Title: Biggest trends for 5G as infrastructure to hit $4.2 billion

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/highlights
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/
Title: CA Privacy/Info We Collect

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/donotsell
Title: CA Do Not Sell My Info

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://privacy.cbs/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

210 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/ 485 KB
117 KB 159ms
145ms Document
text/html 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a8c60d7ae573168606a3559df84e5ddf61b399f7e62b486d90b78b4fb7a192ed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
content-type: text/html; charset=UTF-8
x-tx-id: 24c0a386-c3bd-4e9b-8236-0a33b87033c2
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
last-modified: Thu, 12 Mar 2020 16:48:41 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
date: Thu, 12 Mar 2020 17:07:07 GMT
cache-control: max-age=5400, private
expires: Thu, 12 Mar 2020 18:18:41 GMT
set-cookie: fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure;
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload
accept-ranges: bytes
content-length: 118868

GET
H2 200 main-cb73be9c41-rev.css
zdnet4.cbsistatic.com/fly/2005-fly/css/core/ 349 KB
63 KB 29ms
10ms Stylesheet
text/css 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eeeb3a11db527f906d9727a0f81ec2e8060176f2f32c28d3081bd49b5e4213cd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
status: 200
strict-transport-security: max-age=31536000
content-length: 64125
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:30:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692e45-57295"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:17 GMT

GET
H2 200 controls-cbaacac0d5-rev.css
zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/ 17 KB
4 KB 8ms
6ms Stylesheet
text/css 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-cbaacac0d5-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f6a86ed59c8b7dcf6f04519b0d3d90be03dc117af56a89599496065b47447978

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80870
status: 200
strict-transport-security: max-age=31536000
content-length: 3689
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:30:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692e51-4411"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:17 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 11 KB
4 KB 20ms
19ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8AAA) /
Resource Hash: 75f9d68d6474b9da47853a1611129de9a17dd35e931f5ed5d46cbc87f2c2f663

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
content-md5: BIJtIeAv4g/ijcVi6o769g==
age: 1254
x-cache: HIT
status: 200
content-length: 3741
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:51 GMT
server: ECAcc (ama/8AAA)
etag: 0x8D7BA28629B07DB
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: b90399ac-b01e-0126-3c8d-f80507000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:07 GMT

GET
H2 200 optanon.js Show response
production-cmp.isgprivacy.cbsi.com/dist/ 34 KB
10 KB 7ms
6ms Script
application/x-javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://production-cmp.isgprivacy.cbsi.com/dist/optanon.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

546070e9925b075d0775498c1efd2385c4bbc8c364d0e90721769e7a77dfd7c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1604
via: 1.1 varnish
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 10013
x-xss-protection: 1; mode=block
x-served-by: cache-fra19131-FRA
x-amz-id-2: 7yzqui2VkoO0L2pZzuPe5QHZh+ykr1NLDU96KojxLxZj2qOpI4UKyvgn2QHjwt5h9gwZlI/v/xE=
last-modified: Thu, 20 Feb 2020 21:36:16 GMT
x-timer: S1584032828.752332,VS0,VE0
x-frame-options: SAMEORIGIN
etag: "a5671e7ea8e71476f3d8e93de3c6f695"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
accept-ranges: bytes
x-cache-hits: 96

GET
H2 200 charlie-osborne.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/ 930 B
1 KB 25ms
18ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/charlie-osborne.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b4b2d45758098ad4513cbcb4b8d2ea58c84f37ab1642b9aefd81818da523e8c6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1263417
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 889
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"1cc3633c579a90cfdd895e64021e2163"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 malwarefree-attacks-now-most-popular-tac-5e6107563b8299000150ce0d-1-mar-06-2020-11-11-39-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2020/03/06/e9e3281d-8456-4c4d-8c43-33700544c9ee/thumbnail/570x322/b17f3f3f1456a8faa421e91e57c8d614/ 19 KB
20 KB 9ms
6ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/03/06/e9e3281d-8456-4c4d-8c43-33700544c9ee/thumbnail/570x322/b17f3f3f1456a8faa421e91e57c8d614/malwarefree-attacks-now-most-popular-tac-5e6107563b8299000150ce0d-1-mar-06-2020-11-11-39-poster.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1a0a2b722a3a04a85813d6fc3cf74c3fc5eb052947c744a678fcaf3ceda92bcd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 531067
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 19934
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"3553e3cac8b3c8c26df3ac4a297a215c"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 advertisement.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/ 53 B
195 B 13ms
13ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 518459
status: 200
strict-transport-security: max-age=31536000
content-length: 71
x-xss-protection: 1; mode=block
last-modified: Fri, 06 Mar 2020 16:51:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e627f8f-35"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Mar 2020 17:06:08 GMT

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/2005-fly/js/libs/ 16 KB
6 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80870
status: 200
strict-transport-security: max-age=31536000
content-length: 6288
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:30:45 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692e55-3f88"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:18 GMT

GET
H2 200 bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/ 4 KB
2 KB 20ms
19ms XHR
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8B5A) /
Resource Hash: 56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
content-md5: tnKHGc+Hbu8/XNTAD7qBqA==
age: 1213
x-cache: HIT
status: 200
content-length: 2089
x-ms-lease-status: unlocked
last-modified: Sat, 22 Feb 2020 00:49:50 GMT
server: ECAcc (ama/8B5A)
etag: 0x8D7B7311F4659C5
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c381a97c-001e-009a-6b8d-f85423000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:07 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/5.12.0/ 381 KB
92 KB 21ms
20ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8AF2) /
Resource Hash: 37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
content-md5: 7Kk4zqCmlBKTWyZO1p1w1Q==
age: 1252
x-cache: HIT
status: 200
content-length: 94107
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:32 GMT
server: ECAcc (ama/8AF2)
etag: 0x8D7B70A62368476
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3506f9e3-601e-0009-148d-f8c268000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:07 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame CAB6 187 KB
47 KB 21ms
8ms Script
application/javascript 2a02:26f0:6c00:18c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:18c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:07 GMT
Content-Encoding: br
Last-Modified: Sun, 23 Feb 2020 21:29:42 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 47928

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 mag-white01.png
zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/core/ 1 KB
1 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80870
status: 200
strict-transport-security: max-age=31536000
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692d91-4f1"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:18 GMT

GET
H2 200 ring-animated.svg
zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/video/ 704 B
621 B 7ms
6ms Image
image/svg+xml 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/video/ring-animated.svg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-cbaacac0d5-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80865
status: 200
strict-transport-security: max-age=31536000
content-length: 364
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e692d91-2c0"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Mar 2021 18:39:19 GMT

GET
H2 200 Semibold.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 31ms
12ms Font
font/woff2 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
Origin: https://www.zdnet.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
x-content-type-options: nosniff
age: 1220828
status: 200
strict-transport-security: max-age=31536000
content-length: 20344
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f78"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
H2 200 Regular.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 26ms
6ms Font
font/woff2 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
Origin: https://www.zdnet.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
x-content-type-options: nosniff
age: 1220828
status: 200
strict-transport-security: max-age=31536000
content-length: 20256
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f20"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 logo.png
zdnet1.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
6ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/core/logo.png

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
status: 200
strict-transport-security: max-age=31536000
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692d91-1009"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:18 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 115 B
313 B 111ms
111ms Script
text/javascript 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 572f1c16a97f1f19-FRA

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/2005-fly/js/ 562 KB
180 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

973f7ff6661e32af0258aaea2ab4ae22bdfb0d73c64a7aa71cc36335a5678008

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
status: 200
strict-transport-security: max-age=31536000
content-length: 184289
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:30:45 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692e55-8c822"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:18 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame CAB6 2 KB
1017 B 45ms
34ms XHR
application/json 2a02:26f0:6c00:18c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5280109&v=1.571.0&if=&sl=0&si=7l7s2rj4sd9-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:18c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 66899e5f67b02a7e3185b17d7fa28e2e983bc0173205c2f6d4f04c3a558123fd

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 12 Mar 2020 17:07:07 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 697

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 43 KB
14 KB 31ms
31ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

89a39fe87404de18d2607d59ba5cded97619e30186571849f6cad08357ed7753

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "453 / 915 of 1000 / last-modified: 1584029937"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14483
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/ 94 KB
14 KB 20ms
20ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/en.json
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8AE7) /
Resource Hash: d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
content-md5: naVpQbWe8gSjPtoc7a+kTw==
age: 1204
x-cache: HIT
status: 200
content-length: 14612
x-ms-lease-status: unlocked
last-modified: Sat, 22 Feb 2020 00:50:01 GMT
server: ECAcc (ama/8AE7)
etag: 0x8D7B731263A88EC
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 1cca1291-601e-0149-7b8d-f8add3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:08 GMT

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 282ms
122ms Script
application/javascript 35.190.38.167
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 61 KB
13 KB 7ms
7ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 518463
status: 200
strict-transport-security: max-age=31536000
content-length: 13447
x-xss-protection: 1; mode=block
last-modified: Fri, 06 Mar 2020 16:54:31 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e628047-f278"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Mar 2020 17:06:04 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 15 KB
3 KB 21ms
20ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otFlat.json
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8AC3) /
Resource Hash: 7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
content-md5: 4X6tFR1iNZJA0ugA60GXmg==
age: 1255
x-cache: HIT
status: 200
content-length: 2748
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:29 GMT
server: ECAcc (ama/8AC3)
etag: 0x8D7B70A60DF65FE
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: e91e9430-901e-001c-438d-f800f1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:08 GMT

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 72 KB
13 KB 21ms
20ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otPcPanel.json
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8AF4) /
Resource Hash: 59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
content-md5: CHY1OTgtshtK4vchnpokaA==
age: 1255
x-cache: HIT
status: 200
content-length: 12882
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:30 GMT
server: ECAcc (ama/8AF4)
etag: 0x8D7B70A613D4F2A
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9b3550c8-801e-0080-548d-f87b4c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 12 Mar 2020 21:07:08 GMT

GET
H2 200 integrator.js Show response
adservice.google.be/adsid/ 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.be/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 165 KB
60 KB 31ms
31ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 37ms
37ms XHR
application/json 2a02:26f0:6c00:18c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1584032828100&s=da85e53d948f612022705066d4619ed0e81b90ebb2cb2775375d24bd3dfcf403
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:18c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 86d206e88c7b9985d7bf91227425275e668f5f6398802c25ce4b72aaaf1b5421

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 740

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 99 KB
14 KB 590ms
589ms XHR
text/plain 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3058094442406915&correlator=3188965562149824&output=ldjh&impl=fifs&adsid=NT&eid=21065707%2C21065587&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200312&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%7C7x7%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C300x250%2C728x90%7C970x250%7C970x66&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Candroid%26mfr%3Dfacebook%252Ckaspersky-lab%26tag%3Dmalware%252Cfacebook%252Ctarget%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Duk%26subses%3D3%26session%3Dc%26pv%3D1%26vguid%3D46f08e6c-af55-4640-8f6c-34688d7caea6&cookie_enabled=1&bc=31&abxe=1&lmt=1584031721&dt=1584032828203&dlt=1584032827685&idt=475&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C-20%2C1043%2C1043%2C1008%2C1043%2C429&adys=0%2C285%2C405%2C2424%2C1623%2C3306%2C3609&adks=1512325694%2C3581870410%2C1925781520%2C3289239044%2C3970605601%2C3509234736%2C519614694&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&dssz=29&icsg=33555104&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x4069%7C1585x90%7C370x250%7C370x250%7C370x771%7C370x250%7C1210x90&msz=1585x5%7C1585x90%7C370x250%7C370x250%7C370x771%7C370x250%7C1210x90&ga_vid=1904031832.1584032828&ga_sid=1584032828&ga_hid=1052399404&fws=4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

f51be25529281a7ddc460d94fd08dcc96269f55635236fdf18b7d4b7ed26001f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14208
x-xss-protection: 0
google-lineitem-id: 4745974454,253246569,253246569,241984809,4825966980,241984809,241984809
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239360957,138271463540,138271463546,138271449720,138247024569,75375443409,138271463474
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 69 KB
25 KB 31ms
31ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 5ms
5ms Other
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 nr-1167.min.js Show response
js-agent.newrelic.com/ 26 KB
10 KB 64ms
20ms Script
application/javascript 151.101.114.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1167.min.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-amz-request-id: 9F168BA697B778D0
x-cache: HIT
status: 200
content-length: 10178
x-amz-id-2: yYgBioLjCplIhDxMZm/PKonf0xZGo/IH9CxBrQAf8lWo1+WyLnApygFOHARQZ+4eJQtQu20EMwQ=
x-served-by: cache-hhn4051-HHN
last-modified: Fri, 07 Feb 2020 23:39:55 GMT
server: AmazonS3
x-timer: S1584032828.423255,VS0,VE0
etag: "8155781ab74e51eee2ead2c1d5902e63"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 24433

GET
H2 200 article-4bf1478396-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 148 KB
41 KB 9ms
9ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-4bf1478396-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598131
status: 200
strict-transport-security: max-age=31536000
content-length: 41795
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-25039"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:15 GMT

POST
H/1.1 204
No Content /
686eb51b.akstat.io/ 0
354 B 51ms
36ms Other
image/gif 2a02:26f0:6c00:18b::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://686eb51b.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18b::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 31ms
10ms Script
application/javascript 2a04:4e42:1b::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::645 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
age: 2024086
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: a7sTpjN0rbLZvEEnuHdaTck1VBHekvKhhLC2Mk6PBFUk87JlwOZCikwf5WULADe+/kLh6gJa9yk=
x-served-by: cache-dca17763-DCA, cache-hhn4058-HHN
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1584032828.446188,VS0,VE1
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: 45E7246C4D68C98C
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
638 B 148ms
148ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

be531eb6539e3ef4c074de16da43e99fc1bd3c9b93bd8ae8ff2799dc92a08394

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
X-NewRelic-ID: UQIHWFZXGwIDXFdRAAYDVw==
Sec-Fetch-Dest: empty
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 487
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Mar 2020 16:53:24 GMT
x-frame-options: SAMEORIGIN
date: Thu, 12 Mar 2020 17:07:08 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 0b45d893-df9b-4893-a45c-4a4a5cf02395
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 12 Mar 2020 18:23:24 GMT

GET
H2 200 image-gallery-modal-426b98fe1d-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598129
status: 200
strict-transport-security: max-age=31536000
content-length: 1866
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-1328"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:17 GMT

GET
H2 200 screenshot-2019-12-04-at-15-46-22.png
zdnet2.cbsistatic.com/hub/i/r/2019/12/04/0e9dbe5e-b531-408e-90db-69354c7e3846/thumbnail/170x128/5c091846574476201e70a322d52830d0/ 40 KB
40 KB 14ms
13ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/12/04/0e9dbe5e-b531-408e-90db-69354c7e3846/thumbnail/170x128/5c091846574476201e70a322d52830d0/screenshot-2019-12-04-at-15-46-22.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e4a559d78fc85d59d8472d98d2120bd7dc6f4fafd3cf10e951423a3d4da8e1af

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1257527
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 41122
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"cb2dc70c84b332c8e5aef3045e20c16f"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-12-04-at-15-46-58.png
zdnet4.cbsistatic.com/hub/i/r/2019/12/04/1c22d12b-a0ee-4f1a-a261-d4327586182f/thumbnail/170x128/1903f80a118c9a802fe4f50c9e2a059a/ 53 KB
53 KB 8ms
7ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/12/04/1c22d12b-a0ee-4f1a-a261-d4327586182f/thumbnail/170x128/1903f80a118c9a802fe4f50c9e2a059a/screenshot-2019-12-04-at-15-46-58.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e12918e72f608ae55fb2fc1766300fa335ae898f3236b55160a94f0d81ff48a6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 403763
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 54316
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"c715b7f9c127a03df75863d57da84c6c"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-12-04-at-15-47-31.png
zdnet4.cbsistatic.com/hub/i/r/2019/12/04/f90cf8cb-10fc-448d-8c00-a759e3bb908a/thumbnail/170x128/7a065ebc2de6462b9e0f9192484b8ebe/ 27 KB
27 KB 20ms
19ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/12/04/f90cf8cb-10fc-448d-8c00-a759e3bb908a/thumbnail/170x128/7a065ebc2de6462b9e0f9192484b8ebe/screenshot-2019-12-04-at-15-47-31.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e541f6e3239ffa2ad85574c7712ae9904cef607421be96220250ea831094ea4d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1726920
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 27494
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"8e767a1a905e130ad086869247c3f7f5"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-12-04-at-15-48-08.png
zdnet4.cbsistatic.com/hub/i/r/2019/12/04/eebc9fd0-a8d5-4228-adc8-0f1ee720d99a/thumbnail/170x128/2660cbe971797abc9aa71a6fa5c25d09/ 34 KB
34 KB 13ms
13ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/12/04/eebc9fd0-a8d5-4228-adc8-0f1ee720d99a/thumbnail/170x128/2660cbe971797abc9aa71a6fa5c25d09/screenshot-2019-12-04-at-15-48-08.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

07043ce4c06ad902c7eee0f6539f9f3b8ed8303f6373bd59e25caa5726dc1ba5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1704242
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 34792
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"33acaba956e30e1494c5b84d48694e0e"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-12-04-at-15-48-41.png
zdnet2.cbsistatic.com/hub/i/r/2019/12/04/3f3a5a3d-d2e5-4478-9546-3e88f95b828a/thumbnail/170x128/82bffa8f497d4c84ba6fa7ff239ffa62/ 42 KB
42 KB 13ms
12ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/12/04/3f3a5a3d-d2e5-4478-9546-3e88f95b828a/thumbnail/170x128/82bffa8f497d4c84ba6fa7ff239ffa62/screenshot-2019-12-04-at-15-48-41.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

11ed936cd40f2fa72aee94c65d9ecbdd1f60f6300649bb06a9020ce1661c1766

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1727191
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 42849
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"b91cf8812365f50ff4bda4bcd6206b05"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 disqus-loader-ba8cc73646-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
709 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-ba8cc73646-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598131
status: 200
strict-transport-security: max-age=31536000
content-length: 640
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-57e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:17 GMT

GET
H2 200 screenshot-2020-03-11-at-07-31-51.png
zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96c9637e-e97b-448c-aefb-0dbf835984b5/thumbnail/170x128/bcb670cfd0108b7666469e6c29b16bf6/ 41 KB
41 KB 8ms
7ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96c9637e-e97b-448c-aefb-0dbf835984b5/thumbnail/170x128/bcb670cfd0108b7666469e6c29b16bf6/screenshot-2020-03-11-at-07-31-51.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

946f493e3c35d4106318801e189fd0c48216c4f55845e36857506e12b5154c71

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
age: 102956
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 41989
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "02fcc1b3d50513cb9bdc841e7487fcdb"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2020-03-11-at-07-32-46.png
zdnet4.cbsistatic.com/hub/i/r/2020/03/11/46607751-6abf-4c24-a345-cc27035ba463/thumbnail/170x128/ac7f41335f64f43d6ffdc750e42a283f/ 12 KB
12 KB 15ms
14ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2020/03/11/46607751-6abf-4c24-a345-cc27035ba463/thumbnail/170x128/ac7f41335f64f43d6ffdc750e42a283f/screenshot-2020-03-11-at-07-32-46.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1370ed06d58a38c7a4f035e7937af00e1e79ab823464d2ae1f1d15acedf9bafc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104944
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 11733
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"d20d9896e5f7a733d09c07acb323154f"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2020-03-11-at-07-33-29.png
zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96a416da-996b-444b-a27e-227e5013a5ba/thumbnail/170x128/f48d9d84f767d68feb068c1a804b6347/ 38 KB
38 KB 8ms
7ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96a416da-996b-444b-a27e-227e5013a5ba/thumbnail/170x128/f48d9d84f767d68feb068c1a804b6347/screenshot-2020-03-11-at-07-33-29.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2a6e33b382c1e085fd8fcfde323f3bfb7944aa519fa72b1d079a73a044921e69

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115413
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 38861
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5b84fd06a6f4bd86f9185656ab58b32f"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2020-03-10-at-13-22-53.png
zdnet1.cbsistatic.com/hub/i/r/2020/03/10/4c60fbf9-b3c4-482d-9993-686d5a25a656/thumbnail/170x128/9f8933aa42d97310ec44635d67ea09fa/ 47 KB
47 KB 9ms
8ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2020/03/10/4c60fbf9-b3c4-482d-9993-686d5a25a656/thumbnail/170x128/9f8933aa42d97310ec44635d67ea09fa/screenshot-2020-03-10-at-13-22-53.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

376b9180212e0f47bd4323ef7bf429d35e4b8fc86dae7a7c20cee254b3c9a488

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
age: 183982
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 48321
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "6590962dcc27aaa26e9475704fb39d06"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
888 B 384ms
384ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

017138ceb375bcd031af998b3f37ed9731d17871845151c7f2bbef16b88563b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
X-NewRelic-ID: UQIHWFZXGwIDXFdRAAYDVw==
Sec-Fetch-Dest: empty
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
date: Thu, 12 Mar 2020 17:07:08 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: b888d280-c3d4-4748-adda-2dd55f22d30d
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 front-door-carousel-d989216481-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
7ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598131
status: 200
strict-transport-security: max-age=31536000
content-length: 1552
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-1251"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:17 GMT

GET
H/1.1 200
OK 36c1ca5070 Show response
bam.nr-data.net/1/ 57 B
275 B 468ms
108ms Script
text/javascript 162.247.242.20
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/36c1ca5070?a=138637741&v=1167.2a4546b&to=NV1TZ0MHXxUFWxBYWQwXcFBFD14IS1kWRV8BVFRsQg9fAQhd&rst=982&ref=https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&ap=496&be=231&fe=850&dc=350&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1584032827523,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:2,%22c%22:2,%22s%22:7,%22ce%22:15,%22rq%22:15,%22rp%22:159,%22rpe%22:228,%22dl%22:162,%22di%22:350,%22ds%22:350,%22de%22:350,%22dc%22:849,%22l%22:849,%22le%22:853%7D,%22navigation%22:%7B%7D%7D&fp=338&fcp=338&at=GRpEEQsdExIcZw1VFFgaAwdSVlBVXA5JUgUAXBwHVF9TS1wKVwcbUlkCAFNeBlZXCwcDFE4aRVxBD1IoBVUBEwxAS1RQRBRYEh0aSBNXEExYUF0DZR8UXUYLFAFXX0dUCEU5BUoQWFUOXRMfEwREHw1WA3JPAVRUEQtEVQ8XWwtHUxAaHRFVA0cPB10wSEYHGgsRVQNCDRBXFBMaQFpdXFYvVUReGgZXVQFcVQECS1QCUFlJAAcHCxwKBAIDS1QKXQAHWg4CBAdTVERIGhRQUQdsSENURAtEBUoQWFUOXRMfExJeFg1bLVUUWBoAAgIFA1MGDklUVVsJHAIAAwJLXQ0AAxtSCggCAF4HVVMOUVQUThpEQV1EC0QMTBBBRVhkHm8eEUYRSkIAX1MWFlJcXDoeBxZMDVJaB2QeUl8CQwkNXElcVw5PUEFUS0URAVkPQhsHQEFcQgMcAgFODVJTERVFXBwEQwkTSwFDGwNIQR5SCV4NDV1JRV4HXkVvHkRMSkZZRgtNH0U%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1167.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.20 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS: bam-8.nr-data.net
Software: /
Resource Hash: 5e864c2e3f674c60970513411eaeeeafd2d615d842e65ec01d09ccfcb4a7b38d

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 57
Expires: Thu, 01 Jan 1970 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96c9637e-e97b-448c-aefb-0dbf835984b5/thumbnail/170x128/bcb670cfd0108b7666469e6c29b16bf6/screenshot-2020-03-11-at-07-31-51.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

946f493e3c35d4106318801e189fd0c48216c4f55845e36857506e12b5154c71

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
age: 102956
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 41989
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "02fcc1b3d50513cb9bdc841e7487fcdb"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/03/11/96a416da-996b-444b-a27e-227e5013a5ba/thumbnail/170x128/f48d9d84f767d68feb068c1a804b6347/screenshot-2020-03-11-at-07-33-29.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2a6e33b382c1e085fd8fcfde323f3bfb7944aa519fa72b1d079a73a044921e69

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115413
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 38861
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5b84fd06a6f4bd86f9185656ab58b32f"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2020/03/10/4c60fbf9-b3c4-482d-9993-686d5a25a656/thumbnail/170x128/9f8933aa42d97310ec44635d67ea09fa/screenshot-2020-03-10-at-13-22-53.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

376b9180212e0f47bd4323ef7bf429d35e4b8fc86dae7a7c20cee254b3c9a488

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
age: 183982
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 48321
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "6590962dcc27aaa26e9475704fb39d06"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2020/03/11/46607751-6abf-4c24-a345-cc27035ba463/thumbnail/170x128/ac7f41335f64f43d6ffdc750e42a283f/screenshot-2020-03-11-at-07-32-46.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1370ed06d58a38c7a4f035e7937af00e1e79ab823464d2ae1f1d15acedf9bafc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104944
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 11733
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"d20d9896e5f7a733d09c07acb323154f"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 show-hide-1.0-7bf562809f-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
777 B 10ms
9ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598131
status: 200
strict-transport-security: max-age=31536000
content-length: 673
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-71c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:17 GMT

GET
H/1.1 204
No Content / Show response
684dd305.akstat.io/ 0
354 B 62ms
35ms XHR
image/gif 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd305.akstat.io/?h.pg=article&when=1584032828614&t_other=custom4%7C228&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=927f154f3234c33e1b132d04e6abec1d0d1b792d&h.t=1584032828118&http.initiator=api&rt.start=api&rt.si=e799ffe0-c5fd-4ad2-9ecf-7595fcfe0907&rt.ss=1584032828677&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame AA76 0
0 35ms
35ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssdSfLAns5wHomlCZctmod03zTpLr1MntSypHxGP3AUBhmAk3eGWcn5bMiIkhbBtgINtTKmb7Zen3W0AfLxDvLI-D0FWeDKKg1817mt02pU8Hf5IXuXNSx2lPH_3bb15Uc8tLqk8viUlAPvBad7uEfKQhALU78n1DGme6ZC32tC_dx6EX9OcCR9dWaf15FFnOQXHZvu8I5U9WBieXOg-IPOK44OvicgZPQD_qKMmOWA9AOWspPL3Lu9uSqoiyvHLUWJlf_V1JPY&sai=AMfl-YTNjb6G41xPgMt4masHqqm8a5ZMbvxD7MwyZlwXhinCAt4yTR_HV8_4mASZZqV_xFmJMZII23dc-1RY_KPfJp7d685bcrg5ZezxNg_m&sig=Cg0ArKJSzF9a_hkAUSFnEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame AA76 73 KB
28 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame AA76 314 KB
105 KB 156ms
18ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 26AA 0
0 34ms
33ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqoe6fQMrPI5CSqxkP4QIDUmRIF_S6DzyGsB-PqpjM1Vs7-XJWQ1s31EhoiOY-QjJgHQT0rGqMgiI_7nykw8gq26_QXmLjCsQbiURALNSxLr9Xtbq1RL7iJ5LVHilyGJgRpNShXqpK-f01vU-NRXb1y-jm_sLfEkgcAK9DDfUqU8zQDfuHeSX9i6DJyMvkJCqgOF0x9zcRIxU4F1EHuKYHu2sTXKF7zYwKkio_IRPtNLVMvGhoLKzF2FtXURRqDVub4NA&sai=AMfl-YQxuQaOx6mGYrTvybaZH0TR9NXGfw0lMSkB9a_J1ES8Yxc0YKOEIrMhoAgvJ5dDJuZ5mo-CnegOaQf6TlAqKmfYj-0UrI04vhOZiuAh&sig=Cg0ArKJSzNUIxZCUXDfgEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 26AA 30 KB
9 KB 152ms
23ms Script
text/javascript 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2395
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Thu, 12 Mar 2020 17:47:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 26AA 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 26AA 314 KB
105 KB 194ms
61ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 33B9 0
0 34ms
33ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsumpQkmSOpZQcQ9KWTdSooUYZYzFFbeH-4jbdsqtnBZiyMWP2dKiMLWLopLXodM1mmdJbWOKqiNEZMEpbjErWyiCoBg7mIWnHXKNUpHfqBEWmrjlDFLObU9sE_fyHJ_bGQN3JRYTdgPxcfDbF8U6PTugqrhheAfERRNqGnsOROxZIXId8JQGFC_wYZbHw5RNGlUX7LRghMm_PU0ER_XWcTxSgScW3o0vbM-jRx5vNxWHhILqu6gy1nRkNfFxsFvvvd_Bxo&sai=AMfl-YRGO4flY7_kcXbX8klWdnf0M7G1P46pvgntUhUUp6uJo9-j-hYL8JHx6-ODWKox8ktwgzW2JwwVAay65x4TpvrORcobzjy6K1UxL-ow&sig=Cg0ArKJSzLXPH2HPmqvwEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 33B9 30 KB
9 KB 147ms
23ms Script
text/javascript 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2395
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Thu, 12 Mar 2020 17:47:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 33B9 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 33B9 314 KB
105 KB 194ms
66ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 917A 0
0 35ms
34ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstHstae6BZ_DWYlnfglet_QXZzsuTxs9G_cPV7sJt4QgcTrnG88ARkrWOP-b88Krsk8a9bTXMIaFNnaCqITwff2I_2BHBt6TGTq_bw8xkgObk0IDdB_c52dKL2NpqOZLGhFBwb7B6tO2n2eug5V19vhYnkLM6-0ugBYdbu30DpGqWnzc-u363RDnhvwtRhk9xF6tdXz88cGbpKBmSc_kk-LaLiOvY-ECd4cqWBeTMG4cxxuQpddFMg5xvbJlVsKBbBMZzY&sai=AMfl-YSOZ-6oc-PC_e9v54QH6jQoWoj8N8tkRw9gvJIdwv-Ewh4CI1DUO3QuWQeLvAi8_ned4P0qAlSGRmnYqnzvHzKRWJrL6x_Zls84adCa&sig=Cg0ArKJSzJAAWOChGq7QEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 917A 30 KB
9 KB 142ms
23ms Script
text/javascript 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2395
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Thu, 12 Mar 2020 17:47:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 917A 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 917A 314 KB
105 KB 207ms
85ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2464 0
0 34ms
33ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJqd3VitnTrah09Z3ND44_QmnExNgJW00A1eDdlu0JwzeG4g_RYw1uf22luMOLqoUhDAHVJHmPDW52F8as3smTaeasEvlSKCH8Jy66QSRrIR5VXuW5uwad9zR-jAVaqNIYWtCdvIr676jtxbEWjDhYaBYIaOuhYtIawWv9JWcFtvVpXjiivIFsa0SQEyMx4H_0Lqy-IICJBrZrjlc0wYeX_04WwsCTrHw2zYR0zR8YqYIqFzKZ8kOIpZBwjggcAb94KVoG0x74&sai=AMfl-YSsYq_w9FTiDnuXSCDQFgSBBx07TVQsgam72qPjKf3y8TdGrg53h2J4iaCdHEmFtAbV37Uk2yK9_18WPFLC0uTOaIlffOwqJQUv0f9N&sig=Cg0ArKJSzLEnZ3143g77EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK adKit.min.js Show response
rev.cbsi.com/common/js/ Frame 2464 6 KB
2 KB 217ms
53ms Script
application/x-javascript 92.123.1.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?1592494150
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.123.1.187 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-1-187.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 May 2019 18:29:20 GMT
Server: AkamaiNetStorage
ETag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2464 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 2464 314 KB
105 KB 187ms
77ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame D8E0 0
0 39ms
37ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstYFpAsKYr9aqCopnzZQhBzkDnk2nz22jMfUgE_eJF97KVCWReIWqRZ89xbjwb5KFXCQpyXTW4lxXGNG5cc_tVJtHh7pcillcXR10-mOitW5DDpWqmlJ7jmQ31fJI9V1wbpQXvVZrF8L-d8WWaHZdyZqghX62fAqXdwqnkl7ErOsPA6_HRHizuMhhn90EegvJJICDTXsdJraUipo2lCqxbrKofBVxvtGCsoQG3TQNTNv1CIhvMqTbsrnjReevtH_7Xq_b8&sai=AMfl-YSRtKxivHSwCeWdMW0GAy5_zlnRsATZbGejzhJ9FO0iBZ0oTfLhfIiZbkZPJCk0GRMRhFlr17Ifzz-ZlUsYvWduJMIzDVbCOO66zEE6&sig=Cg0ArKJSzIjNQE7-Kgp-EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame D8E0 30 KB
9 KB 123ms
23ms Script
text/javascript 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2395
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Thu, 12 Mar 2020 17:47:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8E0 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame D8E0 314 KB
105 KB 192ms
89ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 353C 0
0 37ms
34ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZpVPNj6nvfvFvfWcKP853SWoK0fahf6aEZazZQI34H8AAc_f7dHPgRvwNAd_93yxBYgtwXV2TLSMW_mpPd6fNFg7Aa0DSS0G0nkSZ5auVHFhPO6Q7riQH-4Jtt717iabSxl_2jkNURMVNPRiPoUVCdpEIJR7E76lPLIbd0_rq7A7ZtwfTkBlRxy8XYV3OQCr6NXLM2ZMEzePpIsmR9XbZO6UPSbpj33SCKwxpvZBQ2lHnZhv8R0RT7uVXwkiCp8L4L7I&sai=AMfl-YQwMfb09XAypEb_9X0VIyXUD30RZ7GXuuYOIqRb3iZ_0px5yf2xXBxngAwv0LmRLo3f0xgwHrtyU5WDYh5cFF19Rowgxx8q3Q3eQj9G&sig=Cg0ArKJSzLezQ1r8SkOxEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 353C 30 KB
9 KB 122ms
24ms Script
text/javascript 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2395
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Thu, 12 Mar 2020 17:47:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 353C 73 KB
28 KB 18ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 353C 314 KB
105 KB 178ms
88ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35922
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

361e409596b2b1f45202f3566606fcdbd402afc220e35ba2d674cd9b188aa10c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:08 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame C9A4 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3136
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 26AA 2 KB
1 KB 192ms
111ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.5310952179549089&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 23b99fab283e571b8478facb57f44a4e8c671b1280e55f3b31b420b7dc5c952d

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=357
Content-Length: 918
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 33B9 2 KB
1 KB 208ms
118ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.22084608469401568&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: a2808c2a853d90352e4844b46dc33a8a311964106f4263ab80a8912d362aedd3

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=6
Content-Length: 1067
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 917A 2 KB
1 KB 216ms
124ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4964641492229318&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 64c96868964c13a7119092f9f981987acb2933190d7a47702d64dc139274bed6

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=70
Content-Length: 919
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame D8E0 2 KB
1 KB 303ms
114ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4824613412199945&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 549a0d36351f98cb6dc1e5d18754108ef7a91fc407ee1b5fd597d458ae31b833

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=276
Content-Length: 920
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 353C 2 KB
1 KB 379ms
176ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.8564141027303931&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: be674187fd24cc5204dfcea3c76d2e9e8961acf537048a6a0394378e9a0695e6

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=392
Content-Length: 918
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ 112 B
286 B 128ms
44ms Script
text/html 34.254.103.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=7&cm=15&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1584032829026&de=703430632166&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=2&cb=0&ym=0&cu=1584032829026&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatSN=c&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A338%3A338%3A853%3A350&iq=na&tt=na&tu=&tp=&fs=178191&na=603146388&cs=0&callback=DOMlessLLDcallback_55405573
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.103.40 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-103-40.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: baa3323252e7e6396632c9242dc81d887434206b5d45b39d82813023569b297f

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
server: TornadoServer/4.5.3
etag: "658ed59fd084ff7271c1b59c10161663a05ca28b"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 112

GET
H2 200 n.js Show response
geo.moatads.com/ 114 B
288 B 128ms
44ms Script
text/html 34.254.103.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=7&cm=15&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1584032829026&de=703430632166&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=3&cb=0&ym=0&cu=1584032829026&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatSN=c&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A338%3A338%3A853%3A350&iq=na&tt=na&tu=&tp=&fs=178191&na=1611849229&cs=0&callback=MoatDataJsonpRequest_55405573
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.103.40 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-103-40.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 707aa16354c537bcae8512937b80e8570031030d9b7d426ee021b8f1d0ebc360

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
server: TornadoServer/4.5.3
etag: "d321af422aa66a21509b5d3d8f8e439ed7093e43"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 114

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
61 B 15ms
14ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=3058094442406915&bg=!z8ylzNRYnxoUn8h3XDwCAAAANlIAAAAJmQFZUAsHNoEPvop2GIiwLpDD-5seluCMqSj9l5ciSyv2U6deFw9JctCO_U4AxEeUkSuf6xF-ZvkiLzfQWuBQtQFkw3Q62nf5EiyNRY5YbzEX0QrlJR7LRW8fywfIB63eo9zmYwUYTH2HK4elJIk5_VkWfNe5rrxFGB0Q8bXCZaFLyBV8ZuinhwKzuyvKJNGLa0KPGYsMNhgqcP2GAW4d1AMtKajelfxx82I2BmUI3ZX4R_MmWUHUmhXCej8z6xnuGtWmDqwl3gcttzPX1oyd_KqajfDdF5UU_OkUrzLagxK_lvFEW1Yha2RUp77ucVDzv-d_QE89amOO8MybmFAEpXU9-vkKbIA60MDMLZsBbff4_he-dI5Dgfk8OasqLdAs67HqAnj-wX536_3y2Cls9uFq_q8j_mdTO-vdY2FIj3JToGcx-fUXtqyPZjWXdHwWRHLU6zpf4dAc0RpG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:09 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 2464 43 KB
14 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1592494150

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88ce324f93b21f23805917dea33f42320c927c57fbb198c82ac0e7aee40e764d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "453 / 332 of 1000 / last-modified: 1584029937"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14482
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 2464 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2464 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2464 165 KB
60 KB 31ms
30ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 26AA 80 KB
29 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.5310952179549089&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 15057879887190375924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK 3eedff4b-c6e4-4bdc-ac2f-708cdd9c17e4
beacon-eu2.rubiconproject.com/beacon/d/ Frame 26AA 43 B
268 B 160ms
29ms Image
image/webp 69.173.144.155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/3eedff4b-c6e4-4bdc-ac2f-708cdd9c17e4?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BF21B223246049E34F59F456386A8F9F3C8AC04F04858CEA7322DE4789C46710298F9CCABDEFE2F126D748C0D8D7FAA2202F2578040297DBC972F62A5EE36F5393570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF5DCAA7F77662793E83009FDB9DE798169EE3A2627C5AD28A
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Cache-Control: private, max-age=0, no-cache
Expires: 01 Jan 1970 10:00:00 GMT
Server: Rubicon Project
Content-Length: 43
Content-Type: image/webp

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2464 30 KB
7 KB 90ms
89ms XHR
text/plain 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3448348606051204&correlator=2471665554089571&output=ldjh&impl=fifs&adsid=NT&eid=21064169%2C21065391&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200312&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dc%26subses%3D3%26ptype%3Darticle%26vguid%3D46f08e6c-af55-4640-8f6c-34688d7caea6%7Cenv%3Dprod%26session%3Dc%26subses%3D3%26ptype%3Darticle%26vguid%3D46f08e6c-af55-4640-8f6c-34688d7caea6&cookie_enabled=1&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1584032829&dt=1584032829192&dlt=1584032828841&idt=345&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=i8i5q8ocdy3r%7C1ec5l2ny2l8g&ifi=1&ifk=3808974225&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&dssz=15&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1360044775.1584032829&ga_sid=1584032829&ga_hid=1416980741&fws=256%2C256&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

e5c6696d1a08de6c171d47eb8a483da59e99703094f52a0667167377267858b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7447
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239375180,138239375540
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2464 69 KB
25 KB 32ms
31ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 2464 0
0 10ms
9ms Other
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 33B9 80 KB
29 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.22084608469401568&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 15057879887190375924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK 3432a0df-2267-4047-8b30-3abbe0463ece
beacon-eu2.rubiconproject.com/beacon/d/ Frame 33B9 43 B
268 B 104ms
28ms Image
image/webp 69.173.144.155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/3432a0df-2267-4047-8b30-3abbe0463ece?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BB06031CECAF23C03D335BE060531FF50B6805A205E4AFF4F19BB58021B1E89073BC817188FEEC8F1E4A9AFA6E089EF84C4F169EDFE16270A972F62A5EE36F5393570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF642D416F444AD77F83009FDB9DE798169EE3A2627C5AD28A
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Cache-Control: private, max-age=0, no-cache
Expires: 01 Jan 1970 10:00:00 GMT
Server: Rubicon Project
Content-Length: 43
Content-Type: image/webp

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 917A 80 KB
29 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4964641492229318&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 15057879887190375924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK a7fa487d-40df-4109-b373-5ef8ed336058
beacon-eu2.rubiconproject.com/beacon/d/ Frame 917A 43 B
268 B 166ms
36ms Image
image/webp 69.173.144.155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/a7fa487d-40df-4109-b373-5ef8ed336058?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B13D7E8CA8296AC2C953EF83A07809FCF764C08327FDCFF7B3A5F8EF0A5208A1B91D0D74FA59A3068E4A9AFA6E089EF8411BF96B81057A7B9972F62A5EE36F5393570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF5DCAA7F77662793E83009FDB9DE798169EE3A2627C5AD28A
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Cache-Control: private, max-age=0, no-cache
Expires: 01 Jan 1970 10:00:00 GMT
Server: Rubicon Project
Content-Length: 43
Content-Type: image/webp

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 26AA 109 B
171 B 14ms
14ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 26AA 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/ Frame 26AA 222 KB
83 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 84919
x-xss-protection: 0
server: cafe
etag: 4312303881591303584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200305/r20190131/ Frame 7006 0
0 6ms
6ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200305/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200305/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Fri, 06 Mar 2020 00:52:06 GMT
expires: Fri, 20 Mar 2020 00:52:06 GMT
content-type: text/html; charset=UTF-8
etag: 10348540741379653356
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4494
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 576903
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 4212 0
0 71ms
24ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=84035
Expires: Fri, 13 Mar 2020 16:27:44 GMT
Date: Thu, 12 Mar 2020 17:07:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 26AA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1de7a386a3f85824ac7ce503974d22141f43f326968c8c6a83f928224d1915c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 33B9 109 B
171 B 17ms
16ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 33B9 109 B
171 B 16ms
16ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/ Frame 33B9 222 KB
83 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 84919
x-xss-protection: 0
server: cafe
etag: 4312303881591303584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK analytics.js Show response
s.update.rubiconproject.com/2/873648/ Frame 33B9 0
75 B 131ms
35ms Script
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.rubiconproject.com/2/873648/analytics.js?si=59604&di=www.zdnet.com&ap=&dm=15&pi=283812&ti=3432a0df-2267-4047-8b30-3abbe0463ece&r5=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&dt=8736481428691810142000
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 12 Mar 2020 17:07:08 GMT
Content-Length: 0

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E92F 0
0 52ms
25ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=84035
Expires: Fri, 13 Mar 2020 16:27:44 GMT
Date: Thu, 12 Mar 2020 17:07:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 33B9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b2900842ea8dda22f66a5900f373a15a410ea23cc1e41f98ec36a2fcbd3892f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 917A 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 917A 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/ Frame 917A 222 KB
83 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 84919
x-xss-protection: 0
server: cafe
etag: 4312303881591303584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E154 0
0 46ms
23ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=84035
Expires: Fri, 13 Mar 2020 16:27:44 GMT
Date: Thu, 12 Mar 2020 17:07:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 917A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d496d3bd0f310967ff179763146f165ca57c926802037935708217ff71265fec

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 97ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=1&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1584032829225&r=358664566438&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 97ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=1&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1584032829225&r=358664566438&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 99ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1584032829269&r=533077312690&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 99ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1584032829269&r=533077312690&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 98ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271449720&S1id=23605329&S2id=23619609&ord=1584032829291&r=989533509845&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=middle&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame F19D 0
0 36ms
35ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu3DAyiePzFl7DQySEKuJtJwNE8480YmzNqL00_XhWDzv7IJdd37RE30eWKx1_z_zwbMA0nFv8cogq0zXCi9nm_2N2JVM1cSc67wV29CdYhAWeWADIa3zmPY4c8AgpKV9x60zkTAHOEtLjXsARPSQx3ZsTo-Wwi5MQ8rslLvNbhsXRTa82WC5decd6TjXJQZgRf0czBpdehIiDjt05-XSL0VFKY4Gr6slOZec5BTjdm_238HtKdImw4PfjnaxBZcchTX0pSRKWN&sai=AMfl-YSOKH8uHbJEV0i6FM_j2WtvOCMsTkKw3AwcgCxz-FNsP2MZsxVah6VCKOq_vSfZCcjMgr6CBWU8tXuzeB5YA34MhNJh0iuCNgKoG-ft&sig=Cg0ArKJSzOb8o9ep8IBrEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame F19D 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame F19D 314 KB
105 KB 19ms
19ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35921
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2464 73 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame AAA5 0
0 34ms
33ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJExY22QEVwZMheYgB1Z_SsudmJQKgCs5-cdINI7-vvSIyIZsnyXp3qyvsc0oJVq2XMs7l_G9xxmLGxY_oSM1O43mYgUGPz9hrYwCD0LGhhGBFaJLdTN8QSf2NiXFFifQ7feOx-OKrMNOHCUWvIYfxSBBuPO2CiGOLBuNMy0zH0owCXsQnDidQ2Z1rmiM7iYsf9r5ecegp4JfPQsQInzQZXU4EIzk2XR8wBSq6o9auN33LjYRaHYVltS4SbGVbIhD5OHjk4T4G&sai=AMfl-YTaRdgdSO0sgwjvbd5ncOIHLRa5OBmeQffsV5ZFNcfEg6UfsoTP8ctJWKVnw0d0i1fbkispNzkfbhMrt-uTw-HfCs7Wotl899cjH0Jd&sig=Cg0ArKJSzCI3vMqGVH95EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAA5 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28084
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame AAA5 314 KB
105 KB 19ms
19ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: E5E5672C792F6F20
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=35921
accept-ranges: bytes
content-length: 107119
x-amz-id-2: BHTUWMkq+RH9woYZE3p6ZGsKL9pSgrd33Sy69nJbUy2Jnjy7maLCNJv9inLj1/37UQfjzsC8AM0=

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2464 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa404976b5d8a48b4286fb8491d1c4ce16688cdd05d17a2bc57a5e14c166ce6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5239
x-xss-protection: 0

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 5E7C 0
0 244ms
244ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413279&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829203&bpp=16&bdt=385&fdt=167&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=2&ga_vid=1971072696.1584032829&ga_sid=1584032829&ga_hid=1999655024&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=333&biw=1585&bih=1200&isw=728&ish=90&ifk=1148202356&scr_x=0&scr_y=0&oid=3&pvsid=3618399251584500&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.erhiyxp5evyi&fsb=1&dtd=178

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413279&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829203&bpp=16&bdt=385&fdt=167&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=2&ga_vid=1971072696.1584032829&ga_sid=1584032829&ga_hid=1999655024&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=333&biw=1585&bih=1200&isw=728&ish=90&ifk=1148202356&scr_x=0&scr_y=0&oid=3&pvsid=3618399251584500&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.erhiyxp5evyi&fsb=1&dtd=178
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUle92VEsg9Fj43PLIda_mEDEMd7bYnFYtb-YImTg9hQ8P2iDOw4PU9CQJQZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 12 Mar 2020 17:07:09 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 26AA 73 KB
27 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame D8E0 80 KB
29 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4824613412199945&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 15057879887190375924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK c1e5a1a6-7c52-45df-ae04-ae14a8f532e7
beacon-eu2.rubiconproject.com/beacon/d/ Frame D8E0 43 B
268 B 35ms
35ms Image
image/webp 69.173.144.155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/c1e5a1a6-7c52-45df-ae04-ae14a8f532e7?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B1586D472C58DC9D519C59E83D7CEA1FE2AA4D711F4FF489C2D1EF597C87F88A830029F1113E892B06D748C0D8D7FAA22FA6E01E56CFFF9AA972F62A5EE36F5393570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF5DCAA7F77662793E83009FDB9DE798169EE3A2627C5AD28A
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Cache-Control: private, max-age=0, no-cache
Expires: 01 Jan 1970 10:00:00 GMT
Server: Rubicon Project
Content-Length: 43
Content-Type: image/webp

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2464 14 KB
5 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 31D4 0
0 420ms
420ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413248&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829258&bpp=5&bdt=434&fdt=177&idt=177&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1565623352.1584032829&ga_sid=1584032829&ga_hid=1636104168&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=20&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=453&biw=1585&bih=1200&isw=300&ish=250&ifk=886226891&scr_x=0&scr_y=0&eid=410075105&oid=3&pvsid=1122485607173891&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.nmg40majjc8v&fsb=1&dtd=181

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413248&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829258&bpp=5&bdt=434&fdt=177&idt=177&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1565623352.1584032829&ga_sid=1584032829&ga_hid=1636104168&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=20&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=453&biw=1585&bih=1200&isw=300&ish=250&ifk=886226891&scr_x=0&scr_y=0&eid=410075105&oid=3&pvsid=1122485607173891&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.nmg40majjc8v&fsb=1&dtd=181
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUle92VEsg9Fj43PLIda_mEDEMd7bYnFYtb-YImTg9hQ8P2iDOw4PU9CQJQZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 12 Mar 2020 17:07:09 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 33B9 73 KB
27 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 353C 80 KB
29 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.8564141027303931&tk_st=1&rf=https%3A//www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 15057879887190375924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK 1e53d59f-2356-424e-80b9-168a921eca06
beacon-eu2.rubiconproject.com/beacon/d/ Frame 353C 43 B
268 B 38ms
34ms Image
image/webp 69.173.144.155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/1e53d59f-2356-424e-80b9-168a921eca06?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BC94D04397812FB55A0873A8E09C7D10C7F2CAB14DC82E00A52446D97C0BF0C180910D40909B20308E4A9AFA6E089EF841C3ED43073E35F40972F62A5EE36F5393570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF5DCAA7F77662793E83009FDB9DE798169EE3A2627C5AD28A
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Cache-Control: private, max-age=0, no-cache
Expires: 01 Jan 1970 10:00:00 GMT
Server: Rubicon Project
Content-Length: 43
Content-Type: image/webp

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 5FC0 0
0 265ms
265ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413249&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829281&bpp=5&bdt=452&fdt=166&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=2078213747.1584032829&ga_sid=1584032829&ga_hid=1848545154&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1679&biw=1585&bih=1200&isw=300&ish=250&ifk=2777019739&scr_x=0&scr_y=0&oid=3&pvsid=2588318893433168&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q1vyt07be7v&btvi=1&fsb=1&dtd=171

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413249&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829281&bpp=5&bdt=452&fdt=166&idt=167&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=2078213747.1584032829&ga_sid=1584032829&ga_hid=1848545154&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1679&biw=1585&bih=1200&isw=300&ish=250&ifk=2777019739&scr_x=0&scr_y=0&oid=3&pvsid=2588318893433168&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q1vyt07be7v&btvi=1&fsb=1&dtd=171
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUle92VEsg9Fj43PLIda_mEDEMd7bYnFYtb-YImTg9hQ8P2iDOw4PU9CQJQZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 12 Mar 2020 17:07:09 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 917A 73 KB
27 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 29ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=234&fi=1&apd=238&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1584032829225&r=358664566438&t=hdn&os=1&fi2=0&div1=0&ait=115&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=234&fi=1&apd=238&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1584032829225&r=358664566438&t=nht&os=1&fi2=0&div1=0&ait=115&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=233&fi=1&apd=235&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1584032829269&r=533077312690&t=hdn&os=1&fi2=0&div1=0&ait=116&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 29ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=233&fi=1&apd=235&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1584032829269&r=533077312690&t=nht&os=1&fi2=0&div1=0&ait=116&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame D8E0 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame D8E0 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/ Frame D8E0 222 KB
83 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 84919
x-xss-protection: 0
server: cafe
etag: 4312303881591303584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame CF6B 0
0 25ms
24ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=84035
Expires: Fri, 13 Mar 2020 16:27:44 GMT
Date: Thu, 12 Mar 2020 17:07:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame D8E0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 714e8eb9630a16dda6123b98a465011afcaffeea9d9820b0e2dc5afda575f46e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 32ms
32ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1584032829524&r=377697268324&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1584032829524&r=377697268324&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 29ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=251&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271449720&S1id=23605329&S2id=23619609&ord=1584032829291&r=989533509845&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=middle&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=251&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271449720&S1id=23605329&S2id=23619609&ord=1584032829291&r=989533509845&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=middle&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 353C 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 353C 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/ Frame 353C 222 KB
83 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 84919
x-xss-protection: 0
server: cafe
etag: 4312303881591303584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 9613 0
0 31ms
31ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=be
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=84035
Expires: Fri, 13 Mar 2020 16:27:44 GMT
Date: Thu, 12 Mar 2020 17:07:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 353C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02238892376030a69e71f9c11ccd4f133a35281b6c0185ad86699087eb7bace8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 30ms
29ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1584032829561&r=286241594954&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 29ms
29ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1584032829561&r=286241594954&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 47B3 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3137
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame DB6B 0
0 116ms
116ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413251&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829512&bpp=5&bdt=665&fdt=150&idt=150&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1664653436.1584032830&ga_sid=1584032830&ga_hid=1739500928&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2697&biw=1585&bih=1200&isw=300&ish=250&ifk=4189721277&scr_x=0&scr_y=0&eid=26835105&oid=3&pvsid=2796627451943604&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.hvkbm9d48e2k&btvi=1&fsb=1&dtd=156

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=52413251&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829512&bpp=5&bdt=665&fdt=150&idt=150&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1664653436.1584032830&ga_sid=1584032830&ga_hid=1739500928&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2697&biw=1585&bih=1200&isw=300&ish=250&ifk=4189721277&scr_x=0&scr_y=0&eid=26835105&oid=3&pvsid=2796627451943604&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.hvkbm9d48e2k&btvi=1&fsb=1&dtd=156
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUle92VEsg9Fj43PLIda_mEDEMd7bYnFYtb-YImTg9hQ8P2iDOw4PU9CQJQZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 12 Mar 2020 17:07:09 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8E0 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 26AA 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200305&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ab157873cef80b8a9e7dc44feddbb862529f1cbe31df9badd4076da402f48eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5184
x-xss-protection: 0

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 92BC 0
0 218ms
217ms Document
text/html 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413252&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829550&bpp=5&bdt=697&fdt=130&idt=130&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1281712523.1584032830&ga_sid=1584032830&ga_hid=1655138103&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3657&biw=1585&bih=1200&isw=728&ish=90&ifk=1512305787&scr_x=0&scr_y=0&oid=3&pvsid=1333862255284750&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.lxqyvk9hhb7g&btvi=1&fsb=1&dtd=136

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=52413252&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584032829550&bpp=5&bdt=697&fdt=130&idt=130&shv=r20200305&cbv=r20190131&ptt=5&saldr=sa&correlator=4012344664097&frm=23&ife=4&pv=1&ga_vid=1281712523.1584032830&ga_sid=1584032830&ga_hid=1655138103&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3657&biw=1585&bih=1200&isw=728&ish=90&ifk=1512305787&scr_x=0&scr_y=0&oid=3&pvsid=1333862255284750&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.lxqyvk9hhb7g&btvi=1&fsb=1&dtd=136
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUle92VEsg9Fj43PLIda_mEDEMd7bYnFYtb-YImTg9hQ8P2iDOw4PU9CQJQZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 12 Mar 2020 17:07:09 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 353C 73 KB
27 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583960025657856"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 26AA 14 KB
5 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 18BB 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3137
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 917A 7 KB
5 KB 18ms
18ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200305&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b760b3673519f4bf63c5cbef65c96480033c1effa6ac7274bd7bd455e4797881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5182
x-xss-protection: 0

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=205&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1584032829524&r=377697268324&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 917A 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame CEE4 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3137
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 31ms
30ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=198&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1584032829561&r=286241594954&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:09 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D8E0 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200305&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f12bb398c2709b39e94a47a5751605bc5c816130d59a79525300d2f86f42a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5143
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D8E0 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame F949 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3137
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2464 0
64 B 15ms
15ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=3448348606051204&bg=!YGOlY3tYv1po8oODRVcCAAAAYlIAAAAamQFffjgLgaI5bLXExijeD99tmrc_13WOt-GEi6kgQ5O_JQWp8Ve--IC_DCbYvcOg3t6DBTemC8-YBPb-oN92x2-ZQDLxePtJoJabtOQF_qoMtsdnvBbIpFXBjI34DJzl5hzOjzPvWbW_9C3goxq1b4fWB3whuNQDDXYeO5Ccjq0oq4DOXW3AA4NaBr7fL3xRxrz2qdeecyefWHGebLwHpVW0yDBJhXTbkuteT2E2kEd3ipSUoQXJdLBj_wXf6zDNhrOzNXNLviuTKX6ODIi7ffZaDqyjKyRvvqTURZFPOYCoQDbHQXr6CNZBkdkti0YVKIFeDLhxLSJYbGgfMxxrtNnKZJ_cHlD0j7ij2LuJXDlyH12ZaSWqE3rPGzdDHMBpN0EemeMeV8BuEfHzIuU1vgbymDoq1m3sMiggVpXdSARauYxcdWtFryz588SJ2_dQjz8JskHeRUF1-Q-UTgXnfku1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:09 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 33B9 7 KB
5 KB 17ms
16ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200305&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543dfce9a9e42ced2ffdb8c6fdb2191c65a96a4e5a31d88037773eadfc9c03bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5197
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 33B9 14 KB
5 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:09 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26AA 0
55 B 15ms
15ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200305&jk=3618399251584500&bg=!tbaltq5YBAg-GEW4p5MCAAAAgVIAAAAPmQFfEeYL-Fj3eMwymnaj3hbBFFL9mt5ZLPtjrghHq1Q58EAX81Tq4JN8vteAevfO7qvDHMTiocYqQU2_PL1ET_jFsofxcYTe9V5sKkEXIc_Zj8XIxGWw8S4HKxe54e85rBrNhAJK1f8kclAK2wOS5jPRvL9fv54JRsEURxQiWrmHDMXIp1wk_Fq8uJLX1396gAYVyxC3-q5X43_d8nYLkEg2CcCCWNPJw_Xa70pWHIW9eS0cLiTXFiqsJJ7AWSPJfX6ILOck-NwPGcWaS9G54hIYC6iOqfFAHnCDORMaC9IhHGzYtHfKk6_ZkUk2x3gUCws9NN5gUVrt0fE969X8m3dSAkrEtxeNXgxAtnRb-NiceHrY-w1QZUlaBHAkQH7m9qwFCwcUxvFfMhOIiBfD43T7lFTQ8VPKJBTSFLe4ZyZzPIYGOtWpOJH4yv7H46pJXZvTQNv02v1n3wqzwLTmY-kP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:09 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 241F 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3137
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 353C 7 KB
5 KB 23ms
18ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200305&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6432cf6b8db8fbf63ee0ae5e39a8494a93835df75b8495b79c79d18797334e2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 12 Mar 2020 17:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5155
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 353C 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200305/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 12 Mar 2020 17:07:10 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 917A 0
64 B 15ms
14ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200305&jk=2588318893433168&bg=!AAOlAxtYQSwrzxcz1HoCAAABCVIAAAANmQFfLi1LwykwxQaNT1bEU6ihZIydvi988_yIptaQFATBn2lpx2UyEkGYX2RXNbBmQultrfr7Kpcl0AVJQWyDBm_9q4uZh7UxaOGE6w2MHEeUscYuhFEHaBuJt6yR6bs9euOET7vNIta86wkwjWbuRZuLB7Rk_GJMR5LduL8gVH1HM8CUSs3K5nbT3Vu0JNkYJ37O3Hmkk9f_kwxxZ3VQT1gviZxWpMB77rI7lQvo9apbv8SEtEDQYbt78_dHLlIoAkpJsjHlqn77gkvWFm8tTcEKBzp0sPjSp2LZFvwxwuBHWnTavDJJxQStQj4NNPDxfLngvB7nCTxXVqZMvue8iBl9oe0pp5z37jkmdOBhd3l3RGDuQ7zTiqXOc5rqoV4vnWN-w4rffvxu5ZIAnMyUQaPbbzpaa5ClkdHRKIEN8iXIAZTPR3vgwaYUXxe-3IAKJdZH3bvceJlRR30jHgwcAU79

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 2D68 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 12 Mar 2020 16:14:52 GMT
expires: Fri, 12 Mar 2021 16:14:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3138
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8E0 0
64 B 15ms
15ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200305&jk=2796627451943604&bg=!19Sl1MxYM1y3sIbxvO8CAAAA6lIAAAAUmQFf2OFPWTyXpNWQVHNnNiMk17Ry3pi1KVVBYZOKtprOU--3YQGyQn4WuSzPmuqahmvrNjPMcXA6sV5F79y2RbruhCNcNH0jQANb9b5r7NSSL4TiBjsaAjkq--qPXE9EWuK-urWiwcJBveQOgUF-K3jH_AsvWlgdgZk1utjmKkb_tBqcFTl3PVke1z0EOZRYubOIF4OMyrUvfbML7z1HDOKUPkFkfmNBpyJ4q3Mx1MfjvfonB27PcA2h3nir1VxVffSuFHkSkTz9QVzaqd6E7HJd6cFsKPuEHviFh-yFi5wQYbFSYYtYO36NwdC9qXdDCvp2SWXbdHgPkvmALUtFXdJ7pY6XkG8W0PIgdg3qcR2RgCnzxgL5VpF9pOZwcEJdoqs9e8QxIHGOIS69F_FIX1-vbIOtdXj6LRuZcOmZlxUlj7nxzQeDIatjRJbN_ieqfo2KCzy4F8Agu8OClCpmCMYR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 33B9 0
64 B 14ms
14ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200305&jk=1122485607173891&bg=!Y2ClYHhYkUuTkb34PLECAAAAWFIAAAATmQFfPoH5342j-fRSVK88ec-_YRvA-RZOB_I9ZRAweiaVjz1hU6v1Wre3k0haMo14ev6CNPpjtRXazRVLCpK0iq2_m8qC18NG-ev9-l_sApWgXxsTKWIldb_6knOpEGq77CqMdeKQatl-kRwZIwsp0_HNJRgBR-Pph9btRl6ZCROi7ep5MXXUMwlsEm6E_JJjxXzG6Xfq-4m11T6hBWEEiqoo6UhTh8beAYvCW5xKiI-Q7Pp45y6oeUB4fd8wcflvgU8rDuAtnd97fM7T6nTc0E-5WI2MmhlrUs3j2bCalTO3B-PPspY3GT_Njkq2FrWVPp1I3FOlh5nnv3mKUI88Om-ZJXTPtJn1pEfUPkPnxrcrm-9DInPanSXWvGMjePHgLlaeACVT6eQQBIHtmy2gCJxNdsVo8YC1rIJcSIUObK4GO5SuvEsGi0Vtddf4gv-9z5ICYLueTtV-cZ0DeNotUiJq

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 353C 0
55 B 15ms
15ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200305&jk=1333862255284750&bg=!UlGlUUlYVe46r_2S8N4CAAAATlIAAAAJmQFffLFfkw6T5QkOwSD9JcgnJNTFoV_Hr32w80-A_IcOnudat7TeOxDD6FVAdjBQ3XlqlK-tKQl0LiHDiDtGpvHwntkyyFJOtaVM5Zk_q12a84Fhvv8KDlMbk2RvRLLlJjyXfpSHYNc5Es5v3jqaMigYvCr9Mf5yQaQZSuQWRxRpIuIDot5QOsdICFbysXiTnhTnPiiEYxRIhupgYI3z8o4yVe7PJV5-vVwKvgelM3EARVGUi1-yfKgQYBALP_knV47KflRSsnMBQyYIwxyKsDL4XsxuqGFgNdXYeerRkAM-2UfkSPCKLR5EtTw2HHDHw5Qvmy-fMZfSZu1LXOxj8NApVoR5lO7fkzozu6nMAf-0HzoXym8tvDiMcYXqZG6Dhv0Aej7taPe5-2vVGmOgLJhp4XnsMQCxzmn_B_dAZShLee0sqeriEMV0PpQVXzwwklTo3vvxXbxz72tSFUOX11GN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
27ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=868&tet=1065&fi=1&apd=1069&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1584032829225&r=358664566438&t=iv&os=1&fi2=0&div1=1&ait=946&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:10 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:10 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
419 B 28ms
28ms Image
image/gif 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=926&tet=1125&fi=1&apd=1127&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1584032829269&r=533077312690&t=iv&os=1&fi2=0&div1=1&ait=1008&zMoatVGUID=46f08e6c-af55-4640-8f6c-34688d7caea6&zMoatCURL=zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 12 Mar 2020 17:07:10 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 12 Mar 2020 17:07:10 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 26AA 42 B
117 B 17ms
17ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv0Md4-HtK1EPGi3vD-s3veXYuMsocF_SNlKcFY7Vw6Cgt63XA43bs1eIcRwrU6mjEC2oK3n2kI1wNw6aaV0oVvzgKXXXNHIwzKXplp--I&sig=Cg0ArKJSzBnAnrsBW8khEAE&adk=3581870410&tt=-1&bs=1585%2C1200&mtos=1022,1022,1022,1022,1022&tos=1022,0,0,0,0&p=333,429,423,1157&gcm=1&lcs=1&mcvt=1022&rs=3&ht=0&tfs=197&tls=1219&mc=1&lte=1&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1584032828822&dlt&rpt=428&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C4117&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-9-3-8-8-0-0-0&tvt=1217&is=728%2C90&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&r=v&id=osdim&vs=4&uc=9&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200311

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 33B9 42 B
117 B 15ms
14ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvz6cIcoZCmv-DfPcnv9fEFHE5Ndei9YJXw1vIdUxguf5xki8RPry49FZaHN_fnQsyIuqbrvKweDDNCQd56XbcpoFQ27lwh04sCxOjD5Qc&sig=Cg0ArKJSzCREurDFM-S2EAE&adk=1925781520&tt=-1&bs=1585%2C1200&mtos=1092,1092,1092,1092,1092&tos=1092,0,0,0,0&p=453,1043,703,1343&gcm=1&lcs=1&mcvt=1092&rs=3&ht=0&tfs=151&tls=1243&mc=1&lte=1&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1584032828827&dlt&rpt=512&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C4117&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-10-3-9-9-0-0-0&tvt=1241&is=300%2C250&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200311

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 12 Mar 2020 17:07:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.zdnet.com/homepage/xhr/ 250 KB
26 KB 143ms
143ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/homepage/xhr/

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5c63ab5e9beb5f71868cfe636b4fd937a7f246db7fd3458ccbf0fcbf0ef6e673

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
X-NewRelic-ID: UQIHWFZXGwIDXFdRAAYDVw==
Sec-Fetch-Dest: empty
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 26879
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Mar 2020 16:16:58 GMT
x-frame-options: SAMEORIGIN
date: Thu, 12 Mar 2020 17:07:18 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 29120750-1816-4a42-b638-bc85690294a1
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 12 Mar 2020 17:46:58 GMT

POST
H/1.1 200
OK 36c1ca5070 Show response
bam.nr-data.net/events/1/ 24 B
180 B 107ms
107ms XHR
image/gif 162.247.242.20
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/36c1ca5070?a=138637741&v=1167.2a4546b&to=NV1TZ0MHXxUFWxBYWQwXcFBFD14IS1kWRV8BVFRsQg9fAQhd&rst=10982&ref=https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.20 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS: bam-8.nr-data.net
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.zdnet.com
Access-Control-Allow-Credentials: true
Content-Length: 24
Content-Type: image/gif

GET
H2 200 ring.gif
zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ 16 KB
9 KB 6ms
6ms Image
image/gif 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ring.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
status: 200
strict-transport-security: max-age=31536000
content-length: 9039
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692d91-3f75"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:28 GMT

GET
H2 200 ZDLogoMicroRed-x2.png
zdnet1.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ 2 KB
2 KB 7ms
7ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
status: 200
strict-transport-security: max-age=31536000
content-length: 1513
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692d91-6fa"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:28 GMT

GET
H2 200 ZDLogoMicroWhite-x2.png
zdnet3.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ 2 KB
1 KB 7ms
6ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1583951249-asset/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2005-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2005-fly/css/core/main-cb73be9c41-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80868
status: 200
strict-transport-security: max-age=31536000
content-length: 1398
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 18:27:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e692d91-691"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Mar 2020 18:39:28 GMT

GET
H2 200 river-time-ago-438a4081b3-rev.js Show response
zdnet4.cbsistatic.com/fly/js/components/ 757 B
560 B 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-438a4081b3-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598129
status: 200
strict-transport-security: max-age=31536000
content-length: 424
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e6147f1-2f5"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:27 GMT

GET
H2 200 tr-premium-promo-e55876004f-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 467 B
349 B 10ms
10ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-e55876004f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598128
status: 200
strict-transport-security: max-age=31536000
content-length: 287
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e6147f1-1d3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:27 GMT

GET
H2 200 load-more-11b0ac1e21-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 4 KB
2 KB 7ms
7ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/load-more-11b0ac1e21-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 598128
status: 200
strict-transport-security: max-age=31536000
content-length: 1679
x-xss-protection: 1; mode=block
last-modified: Thu, 05 Mar 2020 18:41:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e6147f1-10fb"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Mar 2020 18:58:29 GMT

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
1 KB 498ms
497ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9aa3daddd9a084d6a586e1ded0aea5e70aea41f3a4020e0a22c0982afc83cbe6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
X-NewRelic-ID: UQIHWFZXGwIDXFdRAAYDVw==
Sec-Fetch-Dest: empty
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 761
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
date: Thu, 12 Mar 2020 17:07:19 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: cdb3a638-4fd9-4d26-86d5-f99803294720
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 / Show response
www.zdnet.com/components/tr-promo-asset/xhr/ 2 KB
741 B 249ms
248ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3376f98e91fbd34af8e45dfa130e276e251b19c5e27072512700bd351715b6c4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
X-NewRelic-ID: UQIHWFZXGwIDXFdRAAYDVw==
Sec-Fetch-Dest: empty
Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 603
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Mar 2020 16:39:59 GMT
x-frame-options: SAMEORIGIN
date: Thu, 12 Mar 2020 17:07:19 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 0067a260-02a0-4881-b431-81fae988e4c7
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 12 Mar 2020 18:09:59 GMT

GET
H2 200 load-more-1.0.js Show response
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 8 KB
3 KB 7ms
7ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/2005-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 12 Mar 2020 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 518472
status: 200
strict-transport-security: max-age=31536000
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Fri, 06 Mar 2020 16:52:58 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e627fea-1f51"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Mar 2020 17:06:07 GMT

GET
H2 200 trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/ 3 KB
3 KB 6ms
6ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 17:07:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1123268
status: 200
strict-transport-security: max-age=31536000
content-length: 3111
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e57c5aa-c82"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Mar 2020 17:06:09 GMT

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.zdnet.com/	1970-01-19 08:10:37	Name: RT Value: "sl=1&ss=1584032827523&tt=853&obo=0&bcn=%2F%2F686eb51b.akstat.io%2F&sh=1584032828380%3D1%3A0%3A853&dm=zdnet.com&si=077f0421-d8a0-4c19-8fa7-f08513bdb78d&ld=1584032828380"
.zdnet.com/	1970-01-19 08:43:41	Name: zdnetSessionCount Value: 1
.zdnet.com/	1969-12-31 23:59:59	Name: zdnetSessionStarted Value: true
.zdnet.com/	1970-01-19 08:43:41	Name: arrowImpCnt Value: 1
www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft	1970-01-19 08:01:12	Name: pv Value: 1
.zdnet.com/	1970-01-19 08:43:41	Name: arrowImp Value: true
www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft	1969-12-31 23:59:59	Name: zdnet_ad Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22subses%22%3A%223%22%2C%22session%22%3A%22c%22%7D
.zdnet.com/	1969-12-31 23:59:59	Name: fly_preferred_edition Value: eu
.zdnet.com/	1970-01-19 16:46:08	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Thu+Mar+12+2020+18%3A07%3A08+GMT%2B0100+(Central+European+Standard+Time)&version=5.12.0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fandroid-malware-tweaks-expose-devices-to-browser-app-cookie-theft%2F&groups=1%3A1%2C2%3A0%2C3%3A0%2C4%3A0%2C5%3A0&hosts=H123%3A1%2CH296%3A1%2Ckad%3A1%2Cykx%3A0%2CH74%3A0%2Cnhp%3A0%2CH314%3A0%2CH378%3A0%2Cycm%3A0%2CH551%3A0%2Cqgc%3A0%2CH33%3A0%2Cevp%3A0%2Cmsc%3A0%2CH38%3A0%2Csbj%3A0%2CH82%3A0%2CH93%3A0%2CH98%3A0%2Cshp%3A0%2Cocn%3A0%2Cxol%3A0%2Cldx%3A0%2CH134%3A0%2Cgbj%3A0%2Cxuc%3A0%2CH148%3A0%2Cket%3A0%2Cyhw%3A0%2Cowg%3A0%2Caau%3A0%2CH194%3A0%2Cxzz%3A0%2Cgos%3A0%2Ckij%3A0%2Cqqh%3A0%2CH215%3A0%2CH229%3A0%2Cbjv%3A0%2Cgny%3A0%2Cfgh%3A0%2Ckbc%3A0%2Cezx%3A0%2Clbl%3A0%2Cjyk%3A0%2CH250%3A0%2Cpmv%3A0%2CH270%3A0%2Clzu%3A0%2Cpve%3A0%2CH276%3A0%2Ctch%3A0%2Cxmd%3A0%2Ciax%3A0%2Cqnc%3A0%2CH315%3A0%2Cuxy%3A0%2Cumx%3A0%2CH333%3A0%2CH335%3A0%2CH338%3A0%2Ccnd%3A0%2Cobo%3A0%2CH355%3A0%2Ctas%3A0%2Cqtj%3A0%2Ceod%3A0%2Cxxp%3A0%2Czmt%3A0%2Cmym%3A0%2CH387%3A0%2Cmdi%3A0%2Ciex%3A0%2Chqo%3A0%2CH407%3A0%2CH411%3A0%2Crjz%3A0%2CH412%3A0%2CH420%3A0%2CH430%3A0%2Cwit%3A0%2Clvb%3A0%2CH456%3A0%2CH458%3A0%2CH463%3A0%2CH464%3A0%2Cdmn%3A0%2CH475%3A0%2CH477%3A0%2Cfst%3A0%2Cyxb%3A0%2Ceri%3A0%2CH518%3A0%2Cpcn%3A0%2Cjva%3A0%2Czmy%3A0%2CH545%3A0%2CH554%3A0%2CH566%3A0%2Czou%3A0%2Cdzf%3A0%2Cyon%3A0%2Cdmn%3A0%2Ckuw%3A0%2Cndb%3A0
.zdnet.com/	1969-12-31 23:59:59	Name: fly_default_edition Value: eu
.zdnet.com/	1970-01-19 08:10:37	Name: fly_device Value: desktop
.zdnet.com/	1970-01-19 08:10:37	Name: fly_geo Value: {"countryCode": "de"}

24 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 283) Message: Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 298) Message: Found registered service worker: [object ServiceWorkerRegistration]
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: _injectQueryStringGCP functional
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_chartbeat_video performance
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_tealium functional
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 30) Message: Loading iframes
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_urban_airship targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	(Line 71) Message: blank creative loaded: 138239360957 (7 x 7, pos=nav, slot=nav-ad)
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	(Line 71) Message: blank creative loaded: 138239375180 (372 x 142, pos=, slot=dynamic_showcase__0)
console-api	log	(Line 71) Message: blank creative loaded: 138239375540 (372 x 142, pos=, slot=dynamic_showcase__1)
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/android-malware-tweaks-expose-devices-to-browser-app-cookie-theft/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

684dd305.akstat.io
686eb51b.akstat.io
ads.rubiconproject.com
adservice.google.be
adservice.google.com
adservice.google.de
bam.nr-data.net
beacon-eu2.rubiconproject.com
c.go-mpulse.net
cbsdfp5832910442.s.moatpixel.com
cdn.cookielaw.org
eus.rubiconproject.com
geo.moatads.com
geolocation.onetrust.com
googleads.g.doubleclick.net
js-agent.newrelic.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
production-cmp.isgprivacy.cbsi.com
rev.cbsi.com
s.update.rubiconproject.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
urs.zdnet.com
vidtech.cbsinteractive.com
www.googletagservices.com
www.zdnet.com
z.moatads.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
151.101.114.110
152.195.132.202
162.247.242.20
172.217.18.98
18.203.131.238
23.37.42.132
23.37.55.184
2606:4700:10::6814:b844
2a00:1450:4001:817::2002
2a00:1450:4001:81a::2001
2a00:1450:4001:821::2002
2a02:26f0:6c00:18b::11a6
2a02:26f0:6c00:18c::11a6
2a02:26f0:6c00:19c::11a6
2a04:4e42:1b::444
2a04:4e42:1b::645
2a04:4e42:3::444
34.254.103.40
35.190.38.167
69.173.144.143
69.173.144.155
72.247.226.64
92.123.1.187
95.100.197.246
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
017138ceb375bcd031af998b3f37ed9731d17871845151c7f2bbef16b88563b8
02238892376030a69e71f9c11ccd4f133a35281b6c0185ad86699087eb7bace8
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7
07043ce4c06ad902c7eee0f6539f9f3b8ed8303f6373bd59e25caa5726dc1ba5
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
11ed936cd40f2fa72aee94c65d9ecbdd1f60f6300649bb06a9020ce1661c1766
1370ed06d58a38c7a4f035e7937af00e1e79ab823464d2ae1f1d15acedf9bafc
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1a0a2b722a3a04a85813d6fc3cf74c3fc5eb052947c744a678fcaf3ceda92bcd
1ab157873cef80b8a9e7dc44feddbb862529f1cbe31df9badd4076da402f48eb
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
2176460e4f99c473eeb1eae76a52f66f9b0d06254f003e4b96b39f6e9e78ae1d
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
23b99fab283e571b8478facb57f44a4e8c671b1280e55f3b31b420b7dc5c952d
2a6e33b382c1e085fd8fcfde323f3bfb7944aa519fa72b1d079a73a044921e69
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
3376f98e91fbd34af8e45dfa130e276e251b19c5e27072512700bd351715b6c4
361e409596b2b1f45202f3566606fcdbd402afc220e35ba2d674cd9b188aa10c
376b9180212e0f47bd4323ef7bf429d35e4b8fc86dae7a7c20cee254b3c9a488
37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7
543dfce9a9e42ced2ffdb8c6fdb2191c65a96a4e5a31d88037773eadfc9c03bf
546070e9925b075d0775498c1efd2385c4bbc8c364d0e90721769e7a77dfd7c5
549a0d36351f98cb6dc1e5d18754108ef7a91fc407ee1b5fd597d458ae31b833
551ded00391faf0aaf177f61ba38c63fce32bb4136460182831bdb95b33685f8
56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045
59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a
5c63ab5e9beb5f71868cfe636b4fd937a7f246db7fd3458ccbf0fcbf0ef6e673
5e864c2e3f674c60970513411eaeeeafd2d615d842e65ec01d09ccfcb4a7b38d
5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
6432cf6b8db8fbf63ee0ae5e39a8494a93835df75b8495b79c79d18797334e2d
64c96868964c13a7119092f9f981987acb2933190d7a47702d64dc139274bed6
66899e5f67b02a7e3185b17d7fa28e2e983bc0173205c2f6d4f04c3a558123fd
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6f12bb398c2709b39e94a47a5751605bc5c816130d59a79525300d2f86f42a4a
707aa16354c537bcae8512937b80e8570031030d9b7d426ee021b8f1d0ebc360
714e8eb9630a16dda6123b98a465011afcaffeea9d9820b0e2dc5afda575f46e
7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b
744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803
75f9d68d6474b9da47853a1611129de9a17dd35e931f5ed5d46cbc87f2c2f663
79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef
7a94735f3a0e915a85bd8e216702c3146e1ffd2f6395276c8e5baee1249baaf1
7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92
86d206e88c7b9985d7bf91227425275e668f5f6398802c25ce4b72aaaf1b5421
88ce324f93b21f23805917dea33f42320c927c57fbb198c82ac0e7aee40e764d
89a39fe87404de18d2607d59ba5cded97619e30186571849f6cad08357ed7753
8b2900842ea8dda22f66a5900f373a15a410ea23cc1e41f98ec36a2fcbd3892f
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
946f493e3c35d4106318801e189fd0c48216c4f55845e36857506e12b5154c71
973f7ff6661e32af0258aaea2ab4ae22bdfb0d73c64a7aa71cc36335a5678008
9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb
9aa3daddd9a084d6a586e1ded0aea5e70aea41f3a4020e0a22c0982afc83cbe6
a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5
a2808c2a853d90352e4844b46dc33a8a311964106f4263ab80a8912d362aedd3
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
a8c60d7ae573168606a3559df84e5ddf61b399f7e62b486d90b78b4fb7a192ed
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4b2d45758098ad4513cbcb4b8d2ea58c84f37ab1642b9aefd81818da523e8c6
b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458
b760b3673519f4bf63c5cbef65c96480033c1effa6ac7274bd7bd455e4797881
baa3323252e7e6396632c9242dc81d887434206b5d45b39d82813023569b297f
be531eb6539e3ef4c074de16da43e99fc1bd3c9b93bd8ae8ff2799dc92a08394
be674187fd24cc5204dfcea3c76d2e9e8961acf537048a6a0394378e9a0695e6
cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d496d3bd0f310967ff179763146f165ca57c926802037935708217ff71265fec
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e12918e72f608ae55fb2fc1766300fa335ae898f3236b55160a94f0d81ff48a6
e1de7a386a3f85824ac7ce503974d22141f43f326968c8c6a83f928224d1915c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4a559d78fc85d59d8472d98d2120bd7dc6f4fafd3cf10e951423a3d4da8e1af
e541f6e3239ffa2ad85574c7712ae9904cef607421be96220250ea831094ea4d
e5c6696d1a08de6c171d47eb8a483da59e99703094f52a0667167377267858b3
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
eeeb3a11db527f906d9727a0f81ec2e8060176f2f32c28d3081bd49b5e4213cd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f
f51be25529281a7ddc460d94fd08dcc96269f55635236fdf18b7d4b7ed26001f
f6a86ed59c8b7dcf6f04519b0d3d90be03dc117af56a89599496065b47447978
fa404976b5d8a48b4286fb8491d1c4ce16688cdd05d17a2bc57a5e14c166ce6e
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

www.zdnet.com Open in urlscan Pro 2a04:4e42:1b::444 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

210 Requests

100 %HTTPS

42 %IPv6

19 Domains

32 Subdomains

25 IPs

6 Countries

3855 kBTransfer

10960 kBSize

12 Cookies

34 Outgoing links

Redirected requests

210 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zdnet.com Open in urlscan Pro
2a04:4e42:1b::444 Public Scan

Screenshot
Live screenshot

Full Image

210
Requests

100 %
HTTPS

42 %
IPv6

19
Domains

32
Subdomains

25
IPs

6
Countries

3855 kB
Transfer

10960 kB
Size

12
Cookies

210 HTTP transactions
10 data transactions