URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Submission: On September 19 via api from US

Summary

This website contacted 65 IPs in 6 countries across 56 domains to perform 303 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 2.18.233.143 16625 (AKAMAI-AS)
36 2a04:4e42:1b:... 54113 (FASTLY)
35 2a04:4e42:3::444 54113 (FASTLY)
1 2.20.171.216 16625 (AKAMAI-AS)
3 72.247.225.98 16625 (AKAMAI-AS)
5 23.0.36.169 16625 (AKAMAI-AS)
16 2a00:1450:400... 15169 (GOOGLE)
2 13.32.218.158 16509 (AMAZON-02)
2 52.72.182.57 14618 (AMAZON-AES)
1 4 172.217.16.198 15169 (GOOGLE)
1 35.190.38.167 15169 (GOOGLE)
14 152.199.23.241 15133 (EDGECAST)
2 2a00:1450:400... 15169 (GOOGLE)
13 216.58.210.2 15169 (GOOGLE)
1 2a01:4a0:1338... 201011 (NETZBETRI...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
2 10 34.247.144.106 16509 (AMAZON-02)
4 64.30.230.22 6623 (CBSI-1)
8 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
3 23.39.101.26 16625 (AKAMAI-AS)
2 35.175.13.58 14618 (AMAZON-AES)
1 151.101.114.133 54113 (FASTLY)
1 1 23.5.109.152 16625 (AKAMAI-AS)
2 2 35.190.72.21 15169 (GOOGLE)
2 2 2.18.233.201 16625 (AKAMAI-AS)
2 2 54.194.238.142 16509 (AMAZON-02)
2 3 54.93.117.16 16509 (AMAZON-02)
1 4 52.212.161.170 16509 (AMAZON-02)
1 2600:9000:20b... 16509 (AMAZON-02)
1 23.99.128.52 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 3.225.50.203 14618 (AMAZON-AES)
4 99.80.15.126 16509 (AMAZON-02)
1 54.154.201.99 16509 (AMAZON-02)
2 52.50.119.187 16509 (AMAZON-02)
3 52.49.100.189 16509 (AMAZON-02)
5 185.33.223.216 29990 (ASN-APPNEXUS)
1 4 66.117.28.68 15224 (OMNITURE)
25 151.101.114.2 54113 (FASTLY)
1 104.17.208.240 13335 (CLOUDFLAR...)
1 2600:9000:20b... 16509 (AMAZON-02)
1 6 104.96.148.23 16625 (AKAMAI-AS)
1 2 63.32.253.244 16509 (AMAZON-02)
3 2a03:2880:f02... 32934 (FACEBOOK)
1 35.227.208.151 15169 (GOOGLE)
2 2 66.117.28.86 15224 (OMNITURE)
2 2 172.217.21.194 15169 (GOOGLE)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 52.28.51.75 16509 (AMAZON-02)
4 151.101.113.181 54113 (FASTLY)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
8 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
14 72.247.226.64 16625 (AKAMAI-AS)
1 72.247.224.248 16625 (AKAMAI-AS)
6 35.176.167.2 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 172.217.22.98 15169 (GOOGLE)
1 13.35.253.113 16509 (AMAZON-02)
8 23.58.219.40 16625 (AKAMAI-AS)
1 35.156.77.44 16509 (AMAZON-02)
4 34.231.237.164 14618 (AMAZON-AES)
1 2a04:4e42:1b:... 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:1b:... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
303 65
Apex Domain
Subdomains
Transfer
71 cbsistatic.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
1 MB
25 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
407 KB
20 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
819 KB
20 doubleclick.net
ad.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
219 KB
14 tiqcdn.com
tags.tiqcdn.com
89 KB
14 googletagservices.com
www.googletagservices.com
326 KB
12 ml314.com
ml314.com
in.ml314.com
29 KB
10 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
15 KB
9 lightboxcdn.com
www.lightboxcdn.com
api1.lightboxcdn.com
159 KB
9 viglink.com
cdn.viglink.com
api.viglink.com
85 KB
8 moatpixel.com
cbsdfp5832910442.s.moatpixel.com
3 KB
8 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
13 KB
8 sharethrough.com
native.sharethrough.com
platform-cdn.sharethrough.com
btlr.sharethrough.com
b.sharethrough.com
131 KB
8 zdnet.com
www.zdnet.com
urs.zdnet.com
258 KB
6 scorecardresearch.com
sb.scorecardresearch.com
4 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 demdex.net
dpm.demdex.net
cbsi.demdex.net
4 KB
5 adnxs.com
secure.adnxs.com
6 KB
4 perfectmarket.com
widget.perfectmarket.com
94 KB
3 facebook.net
connect.facebook.net
119 KB
3 eyeota.net
ps.eyeota.net
1 KB
3 everestjs.net
www.everestjs.net
8 KB
3 tru.am
tru.am
beacon.tru.am
14 KB
3 google.com
adservice.google.com
www.google.com
541 B
3 google.de
adservice.google.de
www.google.de
452 B
3 go-mpulse.net
c.go-mpulse.net
57 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 facebook.com
www.facebook.com
247 B
2 imrworldwide.com
secure-us.imrworldwide.com
847 B
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 akstat.io
0211c812.akstat.io
684dd306.akstat.io
708 B
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
847 B
2 betrad.com
l.betrad.com
240 B
1 gstatic.com
fonts.gstatic.com
13 KB
1 jsdelivr.net
cdn.jsdelivr.net
1 KB
1 googleapis.com
fonts.googleapis.com
451 B
1 imgix.net
str-assets.imgix.net
6 KB
1 2mdn.net
s0.2mdn.net
22 KB
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 googleadservices.com
www.googleadservices.com
384 B
1 summerhamster.com
www.summerhamster.com
181 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 trackonomics.net
cdn-magiclinks.trackonomics.net
18 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
15 KB
1 adsrvr.org
match.adsrvr.org
536 B
1 chartbeat.net
ping.chartbeat.net
168 B
1 azurewebsites.net
lightboxapi1.azurewebsites.net
420 B
1 chartbeat.com
static.chartbeat.com
14 KB
1 bluekai.com
tags.bluekai.com
860 B
1 cbsinteractive.com
vidtech.cbsinteractive.com
281 KB
1 akamaihd.net
iicbsi-a.akamaihd.net
271 B
1 indexww.com
js-sec.indexww.com
26 KB
1 evidon.com
c.evidon.com
434 B
0 disqus.com Failed
zdnet-1.disqus.com Failed
303 56
Domain Requested by
21 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
18 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
z.moatads.com
17 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
z.moatads.com
16 images.taboola.com z.moatads.com
cdn.taboola.com
www.googletagservices.com
15 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
14 www.googletagservices.com www.zdnet.com
securepubads.g.doubleclick.net
www.googletagservices.com
ad.doubleclick.net
rev.cbsi.com
13 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.zdnet.com
10 ml314.com 2 redirects tags.tiqcdn.com
ml314.com
www.zdnet.com
z.moatads.com
8 cbsdfp5832910442.s.moatpixel.com
8 z.moatads.com securepubads.g.doubleclick.net
native.sharethrough.com
8 tpc.googlesyndication.com securepubads.g.doubleclick.net
ad.doubleclick.net
tpc.googlesyndication.com
8 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
7 www.zdnet.com zdnet3.cbsistatic.com
native.sharethrough.com
6 px.moatads.com
6 geo.moatads.com z.moatads.com
6 sb.scorecardresearch.com 1 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
5 trc.taboola.com cdn.taboola.com
5 secure.adnxs.com js-sec.indexww.com
5 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
4 b.sharethrough.com
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 pixel.everesttech.net 1 redirects
4 api.viglink.com cdn.viglink.com
4 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
4 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
4 ad.doubleclick.net 1 redirects www.zdnet.com
www.googletagservices.com
3 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
3 saa.cbsi.com tags.tiqcdn.com
3 ps.eyeota.net 2 redirects www.zdnet.com
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
3 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
2 pagead2.googlesyndication.com
2 www.google-analytics.com widget.perfectmarket.com
2 www.facebook.com connect.facebook.net
2 cm.everesttech.net 2 redirects
2 secure-us.imrworldwide.com 1 redirects
2 as-sec.casalemedia.com js-sec.indexww.com
2 cbsi.demdex.net tags.tiqcdn.com
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 in.ml314.com ml314.com
2 tru.am tags.tiqcdn.com
tru.am
2 adservice.google.com www.googletagservices.com
2 adservice.google.de www.googletagservices.com
2 l.betrad.com www.zdnet.com
2 native.sharethrough.com www.zdnet.com
1 fonts.gstatic.com www.lightboxcdn.com
1 cdn.jsdelivr.net www.lightboxcdn.com
1 fonts.googleapis.com www.lightboxcdn.com
1 str-assets.imgix.net native.sharethrough.com
1 btlr.sharethrough.com native.sharethrough.com
1 platform-cdn.sharethrough.com native.sharethrough.com
1 googleads4.g.doubleclick.net www.zdnet.com
1 s0.2mdn.net www.zdnet.com
1 rev.cbsi.com www.zdnet.com
1 ad.yieldmanager.com
1 www.google.de
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 www.googleadservices.com 1 redirects
1 www.summerhamster.com
1 cm.g.doubleclick.net 1 redirects
1 684dd306.akstat.io c.go-mpulse.net
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 cdn-magiclinks.trackonomics.net tags.tiqcdn.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 0211c812.akstat.io zdnet1.cbsistatic.com
1 match.adsrvr.org js-sec.indexww.com
1 ping.chartbeat.net www.zdnet.com
1 beacon.tru.am tru.am
1 api1.lightboxcdn.com www.lightboxcdn.com
1 lightboxapi1.azurewebsites.net www.lightboxcdn.com
1 static.chartbeat.com zdnet2.cbsistatic.com
1 tags.bluekai.com 1 redirects
1 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 urs.zdnet.com zdnet2.cbsistatic.com
1 js-sec.indexww.com www.zdnet.com
1 c.evidon.com www.zdnet.com
0 zdnet-1.disqus.com Failed zdnet2.cbsistatic.com
303 83
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2019-04-23 -
2020-07-22
a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA
2019-02-22 -
2021-02-26
2 years crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2019-02-01 -
2020-05-02
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2018-09-18 -
2019-11-17
a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2019-04-25 -
2021-06-24
2 years crt.sh
*.doubleclick.net
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.zdnet.com
DigiCert SHA2 High Assurance Server CA
2017-12-12 -
2020-12-15
3 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
*.google.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
*.ml314.com
Amazon
2019-03-16 -
2020-04-16
a year crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-24 -
2020-03-01
6 months crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-11 -
2020-03-19
6 months crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA
2018-12-13 -
2020-12-17
2 years crt.sh
*.eyeota.net
Let's Encrypt Authority X3
2019-09-19 -
2019-12-18
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
*.azurewebsites.net
DigiCert SHA2 Secure Server CA
2019-07-22 -
2021-07-22
2 years crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
viglink.com
Amazon
2019-02-09 -
2020-03-09
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2019-06-23 -
2020-09-25
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.trackonomics.net
Go Daddy Secure Certificate Authority - G2
2018-12-22 -
2020-02-20
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2019-02-25 -
2020-02-25
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-08-24 -
2019-10-19
2 months crt.sh
*.urbanairship.com
DigiCert ECC Secure Server CA
2018-06-20 -
2020-06-24
2 years crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
*.summerhamster.com
Let's Encrypt Authority X3
2019-07-23 -
2019-10-21
3 months crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-03 -
2021-02-22
a year crt.sh
www.google.de
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2019-12-24
6 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
imgix.map.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-08-20 -
2020-08-20
a year crt.sh
*.googleapis.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-29 -
2020-04-23
a year crt.sh

This page contains 23 frames:

Primary Page: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Frame ID: F25F7E4F82C39230175A5A9E84A3D553
Requests: 241 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 84C6DA1A71FFC9F15D52B4AEAE6D2E8A
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568923686846&lv=1
Frame ID: F62B27B67E5E72B52A694766C5F9143F
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637044441450568380
Frame ID: 36DDA5F5BEE475909FBE8492615E7E3A
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 064F1299789FE6659DB6DF7BAF4DDF9D
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 7E1A5814DEF16660405D0D155C39E54E
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: C7A85B5CA8FD08510CB3D8FB3036CEE6
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: B4F3F40EB334E9A3F1568DC660A7AA28
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 779106CF21B01C6DF9A8BE693CD311C0
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 2281DD233DCAB0BB4B781D7D27B20F57
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss8ud_e62LRZTzmkOQkQPoTwfbqu4zLl-mkQYH_8bHNuvRFesvN0qqJx5GMDaTQ8562W8_GpLPg_fz0ll0e2rgR5UNtcpOwr83ZsEX8687Y1bU65OWFP78PjeDbgmmWhWHZhkYy7wFrcPqo4-k63YrOmnmZyvZ8D4AdyxJQ4nlgzUbLxFd4U3TOI_stVGUZv_A7TR1GgccCkYwzO2zFH3l9Lij1t4J4QHD-Wm0C9ep7L-uHjaoEByakKirpAX3ZHTCVfWznazTj&sig=Cg0ArKJSzAieTVLZZpwzEAE&urlfix=1&adurl=
Frame ID: 4155624ACC37F497F0FB27E4CE6502A6
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmwBQE0YNFPW2actNaAvAYOTS6ZttLN9B47ykJtqmg64mb2f1_Woa27V2ghlo_91WI133hL678iMJk0kZVMF6iI9E4CboX7hONxT7p2SKwI5NZ5hIphSjU7sizvzadbKOGUmY-FbeZV3tFWwaMBvCQtiprl1TyOTlZgLfou4g-tvKakdczfFArjldJ9uDScqQElffyiaegXQiM1V0dpO6V8pv3CdKB2gVMi7_iLmG8kmb4u5wSxIo5KsIfvUpu2EHd9Tv6HQkNZQ&sig=Cg0ArKJSzEo9uWIIgAmdEAE&urlfix=1&adurl=
Frame ID: 9BA0C94C35724A6897135874BAFABE81
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: 8D10FDF6B691C0A504B9E190D62247FE
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdEB4livscg9QDb44Yh0M_FE6Zb8aMlHQA-l1TO6AchzQGbqs_fbKEqAj5vSsdTcrILg4wVVF-V9yPrkmAKw7bOfSyDUCwM5neLIhGLZIMYHmhRZYrJ7YEunFb2UwnOzoQcKf7Ih45Wn90RBmbWTmO_MSl2rai5IQcMqkopmHp-bySZt05Sz69u-3gnUlP4LTOj_6ZCJGwe2K-J3O3sSMwBbERzJh8Sq2zH7YEkxLW1X1P9-Ei-6CKmS1OsUuQNoPhN_9QMZKOcg&sig=Cg0ArKJSzB2E1zmwewBdEAE&urlfix=1&adurl=
Frame ID: C3E3E12F711A2D1A46EFA864299465D1
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: 19353D31DDA95AD32268BE98E325FAC4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: 0A160862D5B38A3BFAFE1AAF3ED481D6
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuaYb8CdDZzwFMucZVClr9y-EAMsjjJGBfrdFkddqu_CZetA0kDTEHR7TzszzM24ABBjukJo8dFV-MKPeObA89SKZgZVDjc3dwbsBrwzvMTopBTOORjJcK3E8WXRVLLIB89gPHNdNHd3pV8zWysjSkB8kv8bpGmPkHfzZGkcbeskfI69GvD4sgmSFwwzQ3GpHzjCRWFuaKHN1_6aPu8zvq8_yx5vhD74N2FmcyO1HBZcSiNKM-ZQ2bTwjh2LxcA_jJGJHh9CCy-&sig=Cg0ArKJSzLXxjXMQ0681EAE&urlfix=1&adurl=
Frame ID: 55E2F70E5D970B1CD8461A73D90554D4
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Frame ID: FF77327E18E9EF1D81A043E8889BA979
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuREhcHAcdp5n_zmHvhGw-VXIlrEFxTlzBPTjMfuDPJ8e1uojaf6ZHNVqqfBlc3Ux2vD8qYTJBLfWWJRPzz0uawRcDOLp4Hy4XtiAKxuuUpLCrvH1Q5rO1k_Xe10lqQD7-JNptCbP7Dn6rUflLjf9-ZLDVUWR1kKHirJa8dSJ5V1DrpCWpw2lo-nsXtNO1b0O0gDvzIkAfiLPvifc-pcnxjzDf8a-L--PqUU7PQKkz-ukYQiNBIdJ2OywQMXuGMPbugX0gcn7oS&sig=Cg0ArKJSzL0hLA0aBhb6EAE&urlfix=1&adurl=
Frame ID: 224736F7778637BD773FD5416131D1B1
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 1C83FC55B210B5A928CB7EE7FD63C237
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstC63BJdymTyrT1kfN1bWgjzwf8oSRekOb1XGWSXbfLdixvURh35d9JS6Z6cvgrJ2y9Fm0EeehSfNtpNqFthSruPVYMKtiQklzqsplboOH3R3o_kLYmPtUCJM8lgJGg8H90QVmoQ9Ifu6Cx0CkVU-QJuxor8J5lXpDW1JguzAtA9FUTcpAu5dEHuS7Jl4zzX_1Ou6_OsI9yQYgwQRJcREQPNtl7uRe8RvH3U0gfW3HFj1Xyx8TnwC23oTXjl8sxPjCVyR5-LhlS&sig=Cg0ArKJSzNwSL5LWRzA0EAE&urlfix=1&adurl=
Frame ID: 1075E31E6A25D691DDEA0F94153A0B4A
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6eAKSH1nHtJIMsPCJhh5qHKQvr7V6i3UX29D1YLzXtifD06eOynofL9Y-u1qpMg-VbpUAlJTh3QrNNYjIYf1Szghqp8WrrDrCtIrw5JMd0_DVnWpd0hyqzZ9NaNSBRIPN6sgtM7dWwkc6wcFHTBKHbLGyF4StSTkTjG3lh2Aw_R2jR6wCYvvk-Q26FYjRYGWuPcLKfr-GABAbpRIEkIjyQRmF9wYpLVtA8sGtQ4-MGR13-NGDCoyPYvwBLA9iDGcLxgPUPPZF&sig=Cg0ArKJSzM4mifB-XDRMEAE&urlfix=1&adurl=
Frame ID: 2B43664144B863579819F360F5A0D21C
Requests: 3 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637044441450568380
Frame ID: E438B52F1452DBB7B2FAE2A9C32E5F96
Requests: 3 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i


Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

303
Requests

99 %
HTTPS

36 %
IPv6

56
Domains

83
Subdomains

65
IPs

6
Countries

4561 kB
Transfer

12665 kB
Size

32
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151499063203811&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151499063203811%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=Vk1Y%2FQ99999CL%2FB5&person_id=5978151499063203811&eid=50056
Request Chain 77
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151499063203811 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5OTA2MzIwMzgxMRAAGg0Ip8CP7AUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=4e2463a3ae73bb518e67f60f2fd3a6689412be73d90d3b71bf44af6b71121b81f4cb09cee1a4f8eb&person_id=5978151499063203811&eid=50082
Request Chain 78
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151499063203811%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151499063203811%26eid=50220&mm_bnc&mm_bct&UUID=d46d5d83-dee4-4100-91b2-ae31a6ef9fea HTTP 302
  • https://ml314.com/csync.ashx?fp=d46d5d83-dee4-4100-91b2-ae31a6ef9fea&person_id=5978151499063203811&eid=50220
Request Chain 79
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151499063203811 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151499063203811 HTTP 302
  • https://ml314.com/csync.ashx?fp=3ac287355572e217a2fdfc386c782dbd&eid=50146&person_id=5978151499063203811
Request Chain 80
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2ZT0qGxMhHA5QHigfmiHTGI8qU_HMZ60rckZWF7gQPS4&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
  • https://ml314.com/csync.ashx?fp=2ZT0qGxMhHA5QHigfmiHTGI8qU_HMZ60rckZWF7gQPS4&person_id=5978151499063203811&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Request Chain 81
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151499063203811&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151499063203811&redir=
Request Chain 113
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 141
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&c9=
Request Chain 142
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rnd=1568923689678 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rnd=1568923689678&ja=1
Request Chain 161
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFlQZ0tRQUFCTzVVazVhWg HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEAWOxyuPPeqab-xfjkubMw8&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 167
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=KeCDXbXfMoKg3wPRtauQCg&random=1511444586&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358&ipr=y
Request Chain 196
  • https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment= HTTP 302
  • https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_pre=CLm5iJrY3eQCFZi43god22YPrA;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=

303 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
461 KB
109 KB
Document
General
Full URL
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d36fe133d112aef3195ad33bfaedabec470f2893364828e0db54610c007bc5ff
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
cache-control
max-age=5400, private
x-tx-id
fb1d2010-3a3d-4be4-a9bb-cd8325c8f8da
x-xss-protection
1; mode=block
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
expires
Thu, 19 Sep 2019 19:57:09 GMT
last-modified
Thu, 19 Sep 2019 18:27:09 GMT
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options
SAMEORIGIN
access-control-allow-origin
https://www.zdnet.com
content-encoding
gzip
accept-ranges
bytes
content-length
109974
date
Thu, 19 Sep 2019 20:08:06 GMT
set-cookie
fly_device=desktop; expires=Thu, 26-Sep-2019 20:08:06 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "gb"}; expires=Thu, 26-Sep-2019 20:08:06 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=uk; path=/; domain=.zdnet.com; secure fly_default_edition=uk; path=/; domain=.zdnet.com; secure
vary
Accept-Encoding, User-Agent
strict-transport-security
max-age=63072000; includeSubDomains; preload
main-44cfd58730-rev.css
zdnet1.cbsistatic.com/fly/1806-fly/css/core/
357 KB
64 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
31d62de6466df1262b2b50e20fd9f066063c4254609989bf08eb034c9863ee5f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88261
status
200
vary
Accept-Encoding
content-length
65719
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:28:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d828575-593a3"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:04 GMT
controls-55bfadda1b-rev.css
zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/
41 KB
7 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-55bfadda1b-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
79883017f5f729de3512e558228469dfb0f8f5d64f2d117f0102ca898d06e720
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88261
status
200
vary
Accept-Encoding
content-length
6576
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:29:08 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d828584-a561"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:04 GMT
evidon-sitenotice-tag.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
69 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
236619
status
200
vary
Accept-Encoding
content-length
13960
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:22:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7fb6da-1134e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 24 Sep 2019 02:24:27 GMT
country.js
c.evidon.com/geo/
263 B
434 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.20.171.216 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-20-171-216.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5f889444aff25ca5d87419f5a4abb5531ff5e1824bb4c12b0b4e770686b5551e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Wed, 30 May 2018 22:22:40 GMT
server
Apache
status
200
etag
"51ef95ed95600c4c3543a2ed615f4a96:1527718960"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
access-control-max-age
86400
accept-ranges
bytes
access-control-allow-headers
*
content-length
170
snthemes.js
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
94 KB
8 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
477923
status
200
vary
Accept-Encoding
content-length
7763
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:19:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1bb6-177f3"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 21 Sep 2019 07:17:39 GMT
settings.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
33 KB
2 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150329
status
200
vary
Accept-Encoding
content-length
1669
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:22:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7fb6da-828e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 02:22:33 GMT
en.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/
311 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
580442
status
200
vary
Accept-Encoding
content-length
14353
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:06 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4e-4ddff"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Sep 2019 02:54:04 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/
910 B
1 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
age
1939445
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
910
x-xss-protection
1; mode=block
last-modified
Mon, 03 Sep 2018 02:32:23 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 27 Aug 2020 09:23:41 GMT
gootkit.png
zdnet1.cbsistatic.com/hub/i/2019/09/17/3f876e1a-ddbf-4b5e-adbd-559f5136ca5a/5f649a87f5685cc682eda69f651934a7/
63 KB
63 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/2019/09/17/3f876e1a-ddbf-4b5e-adbd-559f5136ca5a/5f649a87f5685cc682eda69f651934a7/gootkit.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6ab3757204be1efa0b178b31717b961e32dc7c4a137c4dcdf9d9acd757797c28
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198465
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
64433
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a08a967a3fb9931ada49bb349c92fa72"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
01-intro.png
zdnet2.cbsistatic.com/hub/i/r/2019/02/03/1fc118b8-287f-467f-8ae7-40613277a63c/thumbnail/170x128/84b4c360fd3c3811f9453d789d76ed51/
17 KB
17 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/02/03/1fc118b8-287f-467f-8ae7-40613277a63c/thumbnail/170x128/84b4c360fd3c3811f9453d789d76ed51/01-intro.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6c67ca4126a3b39a0db2f9546a9009d6344f09e0e34be4c60b7b835357bbcf2a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1003229
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
17374
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f69a675d7f12614552304ed2636e7044"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
02-aws-s3.png
zdnet3.cbsistatic.com/hub/i/r/2019/02/03/d5754639-0902-4720-a0e3-c583a992b83d/thumbnail/170x128/63beb127164753f779517e9814e0f171/
31 KB
31 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/02/03/d5754639-0902-4720-a0e3-c583a992b83d/thumbnail/170x128/63beb127164753f779517e9814e0f171/02-aws-s3.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c7ca72c9211851a635cbeace8657ce6ca37144c4034d6f9000ff9fb513dbc0ba
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
912747
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
31774
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a65b920e6ce1070509a476e3b48aa56f"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
03-mongodb.png
zdnet2.cbsistatic.com/hub/i/r/2019/02/03/bd198e6f-b5fe-4d41-bb16-87381493652f/thumbnail/170x128/d91e4ff7baa797d8995ff3c268c1da01/
28 KB
28 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/02/03/bd198e6f-b5fe-4d41-bb16-87381493652f/thumbnail/170x128/d91e4ff7baa797d8995ff3c268c1da01/03-mongodb.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
79fdfb83309bd0be457dadee31c0a84d0a270a02ead3858163edb06a860c84f5
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4648853
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
28121
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"6ed9184b9ce09f15b4193301f7d9e467"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
06-elasticsearch.png
zdnet4.cbsistatic.com/hub/i/r/2019/02/07/a054149d-2867-4b12-90be-356758f407fd/thumbnail/170x128/ec3c374cb5ab210a7731f50d30110423/
32 KB
32 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/02/07/a054149d-2867-4b12-90be-356758f407fd/thumbnail/170x128/ec3c374cb5ab210a7731f50d30110423/06-elasticsearch.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
44381650043ad53b55fabda73ac870951ac2cd479b9646732b48e396e6661891
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4725549
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
32680
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5df3a42ebea611e314771d5e1bafca74"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
07-kibana.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/07/b5e40641-a3fd-4633-8691-de20758c6738/thumbnail/170x128/8aac357eec65cbd636e90b177b42c732/
30 KB
30 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/07/b5e40641-a3fd-4633-8691-de20758c6738/thumbnail/170x128/8aac357eec65cbd636e90b177b42c732/07-kibana.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4fc0f920b9a4187756ed4414de20cb15651f7f77bc2e5c56bed4082e6b4d2ebe
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3628894
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
30286
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"06fb19e620ff0639ab07f26b4f1b1107"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-09-19-at-13-23-06.png
zdnet1.cbsistatic.com/hub/i/r/2019/09/19/f9104fa8-a193-462b-a26d-dc68294f1213/thumbnail/170x128/e0efd2219eca9a1bf9c3e817cac54e67/
37 KB
37 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/19/f9104fa8-a193-462b-a26d-dc68294f1213/thumbnail/170x128/e0efd2219eca9a1bf9c3e817cac54e67/screenshot-2019-09-19-at-13-23-06.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5eb71a23f7c7e04b24468e3bcccfab972621e566b21d4d395b2b801324db8b5b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
22639
status
200
cneonction
close
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
37686
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"cd609b87010be3afcf62a2b2b94a37b2"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-09-19-at-09-33-11.png
zdnet4.cbsistatic.com/hub/i/r/2019/09/19/af7f7999-6059-4dd6-99e7-c7f298183609/thumbnail/170x128/404317c7d7177c9db10e4462eb73f02d/
24 KB
24 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/19/af7f7999-6059-4dd6-99e7-c7f298183609/thumbnail/170x128/404317c7d7177c9db10e4462eb73f02d/screenshot-2019-09-19-at-09-33-11.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
50419a81e8b9b8fae61d62102fd680cb2d010a641270d1bf53f3402332f0bdbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
age
30522
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
24461
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f5733e3aa5817cf1e0efbc00fee0133b"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
computerusersistock-817606382.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/19/dc7a7c44-9abd-4932-b127-eeb2f7a3ef4d/thumbnail/170x128/fb8e5374e7a0922694f81a25c7715930/
11 KB
10 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/19/dc7a7c44-9abd-4932-b127-eeb2f7a3ef4d/thumbnail/170x128/fb8e5374e7a0922694f81a25c7715930/computerusersistock-817606382.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3d08b932f216c470bc103f01817b70467347dc80849f57445572fe8b9557caa4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
30628
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10399
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"9cc25407f209e031babdac7d3c520ccb"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
mag-white01.png
zdnet1.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/core/
1 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88261
status
200
vary
Accept-Encoding
content-length
936
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-4f1"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:05 GMT
Raleway-Bold.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
51 KB
51 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
nncoection
close
age
5623274
status
200
vary
Accept-Encoding
content-length
52212
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-cbf4"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
Raleway-Regular.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
age
5077446
status
200
vary
Accept-Encoding
content-length
51572
x-xss-protection
1; mode=block
last-modified
Mon, 22 Jul 2019 16:01:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d35dde5-c974"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jul 2020 01:11:57 GMT
Raleway-Light.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
age
5623274
status
200
vary
Accept-Encoding
content-length
51608
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-c998"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
screenshot-2019-09-19-at-09-35-28.png
zdnet3.cbsistatic.com/hub/i/r/2019/09/19/21cba89b-62f0-4f19-8d6e-1f35f7c07d86/thumbnail/170x128/dd41d2fee24b8ac157b510c0869b798e/
31 KB
31 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/19/21cba89b-62f0-4f19-8d6e-1f35f7c07d86/thumbnail/170x128/dd41d2fee24b8ac157b510c0869b798e/screenshot-2019-09-19-at-09-35-28.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
89437728baeaed41cd20c297085f546e48a421b62ec6457cc722f2128549869f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
36498
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
32060
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b78f81d5bdfed3168c472b237f37b43a"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ubisoft.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/170x128/79986b4342dc99bd918887f01dff1cf5/
6 KB
6 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/170x128/79986b4342dc99bd918887f01dff1cf5/ubisoft.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0b13f9ad3def17b72bfda7f42766042b0f6810bee501425ae024bb1e630bf
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71022
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5671
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b476828992f393a09339cf6270d30aa8"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
php.png
zdnet4.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/170x128/4d414e119637a08ac89db3a162768e86/
3 KB
3 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/170x128/4d414e119637a08ac89db3a162768e86/php.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a5961bc7be5b4f176cce4b2b8b2b5af1744b19d7348c4aa82a62b036c30602c5
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4645868
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
2571
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"0cd60efb5578cd967c3c23894f305800"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
msbuyssemmle.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/18/bbff4d63-495d-4b45-b048-b4786d5d9a8f/thumbnail/170x128/a6a63a3d77bb05a7dda309ba97ef0799/
3 KB
3 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/18/bbff4d63-495d-4b45-b048-b4786d5d9a8f/thumbnail/170x128/a6a63a3d77bb05a7dda309ba97ef0799/msbuyssemmle.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4937f9c9905ef23a46422b468695b0f332d492ff592f8712c37639c30a719350
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
85415
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
2738
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"fb3f76858cb38e5b7fd113e0bc1c0721"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
windows-defender-scan.png
zdnet4.cbsistatic.com/hub/i/r/2019/09/18/c0659ff4-2a67-4c3a-873d-47a0ceb9e606/thumbnail/170x128/da19e1a909a187f8a15065392b182c2f/
8 KB
8 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/18/c0659ff4-2a67-4c3a-873d-47a0ceb9e606/thumbnail/170x128/da19e1a909a187f8a15065392b182c2f/windows-defender-scan.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
98ed0b4b2f8fc0b0014bab1914433944d87a9d9fb7f3e068763a5198aeeb1c94
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
87598
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7743
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"e2c4c0b38669387a2a842e1fe391d233"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
cryptocurrency.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/01/23/cbb6cd78-3703-46ae-aafd-b623c25cde39/thumbnail/170x128/a5f275ee9b718406719e22482ed211cd/
5 KB
6 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/01/23/cbb6cd78-3703-46ae-aafd-b623c25cde39/thumbnail/170x128/a5f275ee9b718406719e22482ed211cd/cryptocurrency.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0962d49d8a2007c6c4da8a2098c0e2cb52e61298ebdff2fd7ec4546942b0719b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
105420
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5565
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"80f24ef493982c552b6943f1411f7e2c"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1806-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88262
status
200
vary
Accept-Encoding
content-length
6305
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:28:49 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d828571-3f09"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:04 GMT
logo.png
zdnet2.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88261
status
200
vary
Accept-Encoding
content-length
4128
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-1009"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:04 GMT
vendorlist.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
113 KB
51 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578038
status
200
vary
Accept-Encoding
content-length
52305
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:07 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4f-1c3b9"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Sep 2019 03:34:06 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1806-fly/js/
209 KB
69 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
cd7e202860108c364068ba0dfc50f8f78b12c20cab30723feff677fb6658b292
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88261
status
200
vary
Accept-Encoding
content-length
70882
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:28:51 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d828573-34419"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:05 GMT
ls-zdnet.js
js-sec.indexww.com/ht/
85 KB
26 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 20:05:31 GMT
Server
Apache
ETag
"762d81-15269-592ed79c0ef93"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26184
Expires
Thu, 19 Sep 2019 21:08:07 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 84C6
187 KB
55 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
www.googletagservices.com/tag/js/
40 KB
13 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6ca19d70def89831ee636a9a0ff20430686597eacf06f0d6253b5babc5f72e9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"284 / 574 of 1000 / last-modified: 1568909619"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
12708
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:06 GMT
sfp.js
native.sharethrough.com/assets/
417 KB
117 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.218.158 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-218-158.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8f7d259350c45463129525e55790ac6af9f9204b28bbd06d1d9158439228bbf2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:08 GMT
content-encoding
gzip
last-modified
Thu, 19 Sep 2019 18:14:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA56
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
hYz8aZA_FESm-5pyEm3Xec2oci3tcaqM4UI9eDkuqxXHh07tWBMNLw==
via
1.1 bab68affea15bbe0bb14b61f027cc282.cloudfront.net (CloudFront)
expires
Thu, 19 Sep 2019 19:14:10 GMT
evidon-banner.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
8 KB
3 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
595156
status
200
vary
Accept-Encoding
content-length
2440
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:04 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4c-1faf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 19 Sep 2019 22:40:17 GMT
18863
l.betrad.com/site/v3/425/3445/6/1/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/6/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.182.57 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-72-182-57.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
;ord=1568923686630
ad.doubleclick.net/ddm/ad/wwzdpxxhs/
43 B
491 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/ad/wwzdpxxhs/;ord=1568923686630?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f6.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
urs.js
urs.zdnet.com/sdk/
50 KB
50 KB
Script
General
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
18863
l.betrad.com/site/v3/425/3445/6/4/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/6/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.182.57 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-72-182-57.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
scrolling-mpu-22779a851e-rev.js
zdnet3.cbsistatic.com/fly/js/components/
956 B
626 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
100019
status
200
vary
Accept-Encoding
content-length
491
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:26:49 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7fb7c9-3bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 16:21:07 GMT
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
93 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DD6) /
Resource Hash
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Mon, 16 Sep 2019 18:11:12 GMT
server
ECAcc (lha/8DD6)
etag
"4063075910"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19393
expires
Thu, 19 Sep 2019 20:13:06 GMT
integrator.js
adservice.google.de/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019091201.js
securepubads.g.doubleclick.net/gpt/
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js?21064578
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
511c23178d504d371d22fb6899174f448db32523e9cacd2860306a2b3b8cc1f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 12 Sep 2019 13:06:13 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
58953
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:06 GMT
config.json
c.go-mpulse.net/api/ Frame 84C6
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5229746&v=1.571.0&if=&sl=0&si=trqefaru3wo-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b49353d5c918e8e37556eea8f23dfb856775024b8389034b0df46bbb52b18fa4

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
693
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
22 B
271 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a01:4a0:1338:28::c38a:ff12 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Cache-Control
max-age=96343
Server
AkamaiNetStorage
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
78 KB
28 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
cf-cache-status
HIT
age
262355
cf-ray
518e3092bd8d8caa-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 19 Sep 2019 20:38:06 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D1E) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECAcc (lha/8D1E)
etag
"392561602"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D27) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECAcc (lha/8D27)
etag
"3447796852"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DDB) /
Resource Hash
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Wed, 04 Sep 2019 18:05:01 GMT
server
ECAcc (lha/8DDB)
etag
"3504427907+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48569
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
958 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D3E) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D3E)
etag
"2267415266"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D32) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D32)
etag
"3334871598"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D1A) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECAcc (lha/8D1A)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Fri, 04 Oct 2019 20:08:06 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
972 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C89) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECAcc (lha/8C89)
etag
"1907756232+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Fri, 04 Oct 2019 20:08:06 GMT
tag.aspx
ml314.com/
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1982019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 05:56:28 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=35301
Connection
keep-alive
Content-Length
11933
Expires
Fri, 20 Sep 2019 05:56:28 GMT
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
4f9457dd3bd122ecd2b051ccde197acc46c2efb43c47ce4e0bd88ced9f07bf5d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Server
Apache/2.4.25
Etag
BdOybV2D4CfcGLXVlEs.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=215
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame F62B
326 B
546 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568923686846&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
1683b7845dcb3f17015d7f300c9da255ee8b8b739541a8b4c5598a4b95940188

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
76219
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
518e30930d3dcb98-VIE
cbsinteractive.js
tru.am/scripts/custom/
3 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
content-encoding
br
cf-cache-status
MISS
x-guploader-uploadid
AEnB2Ur5j3Go9y6xZLe2WviMJMLbPXFGJuzuDSRSpef9FAvbIlM6gVz7on_A-BUHAMNQRD-Z8E9C_TyOpvu7ARlHmArWmj2q-Q
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Tue, 30 Apr 2019 19:32:26 GMT
server
cloudflare
etag
W/"c486c91d1321adf59073588524182108"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation
1556652746634603
cache-control
public, max-age=86400
x-goog-stored-content-length
2725
cf-ray
518e30933bb7cbc4-VIE
expires
Fri, 20 Sep 2019 20:08:07 GMT
st.v3.js
www.everestjs.net/static/
25 KB
7 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.39.101.26 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-39-101-26.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Aug 2019 09:05:18 GMT
Server
Apache
ETag
"1ff0663-624a-58fe7d2af0fea"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=38312
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7175
Expires
Fri, 20 Sep 2019 06:46:39 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=166
Content-Length
6423
Expires
Thu, 19 Sep 2019 20:38:07 GMT
pixel.gif
cdn.viglink.com/images/
43 B
103 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=5.534595176998358
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
cf-cache-status
HIT
age
10
cf-ray
518e3092edb98caa-VIE
status
200
content-length
43
x-amz-id-2
HrrKeHwcpae7WIw2OrZ71qNBKOTtGe87zi7c46ReqYsyaDilbmLNVsrHM//KTvEu+OHWwIYX9P0=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
BCF6197221BF5488
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
pixel.gif
cdn.viglink.com/images/
43 B
265 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=5.534595176998358
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
cf-cache-status
HIT
age
10
cf-ray
518e3092edba8caa-VIE
status
200
content-length
43
x-amz-id-2
HrrKeHwcpae7WIw2OrZ71qNBKOTtGe87zi7c46ReqYsyaDilbmLNVsrHM//KTvEu+OHWwIYX9P0=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
BCF6197221BF5488
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame F62B
732 KB
124 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568923686846&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5611e0fcae195ff1fb019d819f1a6e49eeb9ea8a37474eb611777edb07ec1856

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
Y2NLgN18abkj1kHEgzUKGw==
age
76218
cf-polished
origSize=1151166
status
200
last-modified
Wed, 18 Sep 2019 22:55:45 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
ab8e5308-001e-0062-6774-6e1219000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
518e30934e07cb98-VIE
expires
Fri, 18 Sep 2020 20:08:06 GMT
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&pv=1568923686942_xhnngwhy3&bl=en-us&cb=5126243&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1568923686942_xhnngwhy3&cid=623cb559-47fd-413f-b0d7-c357b8460777&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1982019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5e2d4d1e5fea6212e0b4875a4a1c5d2db1e83137d2688a184f322cb0ecf753e9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:06 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
520
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1982019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1982019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.13.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-175-13-58.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Fri, 20 Sep 2019 20:08:07 GMT
article-a7b840b831-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
163 KB
46 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-a7b840b831-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
987e579383d314629d416356d4241c927d4e2ebc86623431e8d810b1296bfb87
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88260
status
200
vary
Accept-Encoding
content-length
46589
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:28:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d828575-28a66"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:05 GMT
fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637044441450568380
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:06 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
q4B4xYJoZwx9ikt94o1nCA==
age
76216
cf-polished
origSize=6016
x-ms-meta-cbmodifiedtime
Wed, 10 Apr 2019 18:50:43 GMT
status
200
last-modified
Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
f4037a0e-a01e-0046-0974-6e8b57000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
518e30939f7ecb98-VIE
expires
Fri, 18 Sep 2020 20:08:06 GMT
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 36DD
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637044441450568380
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637044441450568380
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
cookie
__cfduid=d1ea5e2c11e9f1c501ee93d551d882e9a1568923686
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
date
Thu, 19 Sep 2019 20:08:06 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Wed, 18 Sep 2019 22:55:45 GMT
x-ms-request-id
f9cee776-401e-010c-0fb8-6efd65000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
HIT
age
46867
expires
Fri, 18 Sep 2020 20:08:06 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
518e3093af92cb98-VIE
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/
35 B
256 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1568923686971&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:06 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1170413
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
518e3093af91cb98-VIE
cf-bgj
imgq:85
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/
1 MB
281 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
content-encoding
gzip
age
1944293
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by
cache-dca17747-DCA, cache-hhn4080-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1568923687.072237,VS0,VE0
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
F767A360D0453B01
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 7
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151499063203811&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151499063203811%26eid=50056
  • https://ml314.com/csync.ashx?fp=Vk1Y%2FQ99999CL%2FB5&person_id=5978151499063203811&eid=50056
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=Vk1Y%2FQ99999CL%2FB5&person_id=5978151499063203811&eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Fri, 20 Sep 2019 16:08:07 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=Vk1Y%2FQ99999CL%2FB5&person_id=5978151499063203811&eid=50056
Date
Thu, 19 Sep 2019 20:08:07 GMT
Connection
keep-alive
Content-Length
0
BK-Server
3d24
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151499063203811
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5OTA2MzIwMzgxMRAAGg0Ip8CP7AUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=4e2463a3ae73bb518e67f60f2fd3a6689412be73d90d3b71bf44af6b71121b81f4cb09cee1a4f8eb&person_id=5978151499063203811&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=4e2463a3ae73bb518e67f60f2fd3a6689412be73d90d3b71bf44af6b71121b81f4cb09cee1a4f8eb&person_id=5978151499063203811&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Fri, 20 Sep 2019 16:08:07 GMT

Redirect headers

date
Thu, 19 Sep 2019 20:08:07 GMT
via
1.1 google
status
307
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ml314.com/csync.ashx?fp=4e2463a3ae73bb518e67f60f2fd3a6689412be73d90d3b71bf44af6b71121b81f4cb09cee1a4f8eb&person_id=5978151499063203811&eid=50082
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151499063203811%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151499063203811%26eid=50220&mm_bnc&mm_bct&UUID=d46d5d83-dee4-4100-91b2-ae31a6ef9fea
  • https://ml314.com/csync.ashx?fp=d46d5d83-dee4-4100-91b2-ae31a6ef9fea&person_id=5978151499063203811&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=d46d5d83-dee4-4100-91b2-ae31a6ef9fea&person_id=5978151499063203811&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Fri, 20 Sep 2019 16:08:07 GMT

Redirect headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Server
MT3 1734 ed2a032 master zrh-pixel-x18
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=d46d5d83-dee4-4100-91b2-ae31a6ef9fea&person_id=5978151499063203811&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Thu, 19 Sep 2019 20:08:06 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151499063203811
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151499063203811
  • https://ml314.com/csync.ashx?fp=3ac287355572e217a2fdfc386c782dbd&eid=50146&person_id=5978151499063203811
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=3ac287355572e217a2fdfc386c782dbd&eid=50146&person_id=5978151499063203811
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Fri, 20 Sep 2019 16:08:07 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:07 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=3ac287355572e217a2fdfc386c782dbd&eid=50146&person_id=5978151499063203811
Cache-Control
no-cache
X-Server
10.45.24.157
Connection
keep-alive
Content-Length
0
Expires
0
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2ZT0qGxMhHA5QHigfmiHTGI8qU_HMZ60rckZWF7gQPS4&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
  • https://ml314.com/csync.ashx?fp=2ZT0qGxMhHA5QHigfmiHTGI8qU_HMZ60rckZWF7gQPS4&person_id=5978151499063203811&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
70 B
171 B
Image
General
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.93.117.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-93-117-16.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Length
70
Content-Type
image/gif

Redirect headers

Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control
private
Connection
keep-alive
Content-Length
168
Expires
Fri, 20 Sep 2019 16:08:07 GMT
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151499063203811&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151499063203811&redir=
42 B
776 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151499063203811&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.161.170 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-161-170.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v042-0cf1b00a2.edge-irl1.demdex.com 5.59.0.20190904135845 4ms (+1ms)
Pragma
no-cache
X-TID
ZFCO7fYXQcY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
X-TID
180W15iZSmQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151499063203811&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
chartbeat.js
static.chartbeat.com/js/
35 KB
14 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:5a00:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:07:03 GMT
content-encoding
gzip
last-modified
Thu, 01 Aug 2019 01:56:46 GMT
server
nginx
age
64
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA56
x-amz-cf-id
Wour-KvVjy8cPJ3wFH9XO3t6p-wQJlxsfbBB2OH3m79aHcQckj4ujw==
via
1.1 bab68affea15bbe0bb14b61f027cc282.cloudfront.net (CloudFront)
expires
Thu, 19 Sep 2019 22:07:03 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
539316
status
200
vary
Accept-Encoding
content-length
4877
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:08 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c50-2fdf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Sep 2019 14:19:30 GMT
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1568923687019&s=e048ebef69a5cd0746887f4f8bf7980644e2f98c840537926061729d0c4605b1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
daeee543d809373883b98fcdd914fe148875807360408aea3eed5874733f1bdb

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
737
z
lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/
254 B
420 B
Script
General
Full URL
https://lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1568923687085&callback=jQuery1710579799984051174_1568923686965&_=1568923687086
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
381f5020ebfe45da4c04d671ec56fda1bdf6b7fdaec9b46b8369340ba9f27102

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:08 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Content-Length
254
Content-Type
application/javascript
z.gif
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO...
183 B
578 B
XHR
General
Full URL
https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba

Request headers

Accept
*/*
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
content-encoding
br
cf-cache-status
HIT
age
25932
x-powered-by
ASP.NET
status
200
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
access-control-allow-credentials
true
cf-ray
518e309498225a12-VIE
expires
Fri, 20 Sep 2019 20:08:07 GMT
ta-pagesocial-sdk.js
tru.am/scripts/
35 KB
12 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 18 Apr 2019 03:51:14 GMT
server
cloudflare
age
6309
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
518e309468efcbc4-VIE
expires
Fri, 20 Sep 2019 20:08:07 GMT
beacon
beacon.tru.am/
0
333 B
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:07 GMT
via
1.1 google
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
518e30950a5e59b2-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1568923687325
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.161.170 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-161-170.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
918ff32e8386f866bb2ce61d337b976ce73d48a68f215d99927d2febaf3c156a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v042-0c94a6292.edge-irl1.demdex.com 5.59.0.20190904135845 4ms (+2ms)
Pragma
no-cache
Content-Encoding
gzip
X-TID
YTudsdZUR20=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
671
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
139 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1568923687325
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D56) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (lha/8D56)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Thu, 19 Sep 2019 20:18:07 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&u=DRLhUZB4tCirCRI5Rv&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=7207&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1481&t=DlYCo2BqM9nqDAbdOrDXDN23BTPBGt&V=116&i=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&tz=-120&_acct=anon&sn=1&sv=z2H8pCfr0NKCSBdkkDtiOjvItMTs&sd=1&im=067b2ff3&_
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.50.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-50-203.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Thu, 19 Sep 2019 20:08:07 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
ping
api.viglink.com/api/
266 B
946 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
a2db833a2d180d6b466d9fe89d94b0295ef00f889dc15768a204cc7d9227fb05

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
266
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rid
match.adsrvr.org/track/
109 B
536 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.201.99 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-201-99.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
3fd826e43847a2346d37d18e97a553b5966c6e3e22ad3be8ab4a3efd28396478

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 19 Sep 2019 20:08:07 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Sat, 19 Oct 2019 20:08:07 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=8469d8da-6f0f-46c7-b073-0b55149c0e08&assettitle=gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password&assettype=content_article&pubdate=2019-09-17%2013%3A00%3A00&viewguid=623cb559-47fd-413f-b0d7-c357b8460777&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1568923687403&ld=www.zdnet.com&ldc=0fad0016-258b-4295-9f5e-3834d9a08f19&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=BdOybV2D4CfcGLXVlEs&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&title=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:07 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=952
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 064F
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.119.187 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-50-119-187.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=46454961277536362663058320685457900071
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Tue, 10 Sep 2019 14:30:33 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=46454961277536362663058320685457900071;Path=/;Domain=.demdex.net;Expires=Tue, 17-Mar-2020 20:08:07 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
S+XOSg8+T2U=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/
90 B
583 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=46250790873254166583037357462225766239&ts=1568923687414
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.49.100.189 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-49-100-189.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
faf76c260e80e58ae33959e1811a7b6d4ec9626f44c2a2910e6d5055f05a01e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Thu, 19 Sep 2019 20:08:07 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-76fc945c4d-j9c84
vary
Origin
x-c
master-983.I1f9e38.M0-267
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-type
application/x-javascript
content-length
90
x-xss-protection
1; mode=block
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
377b570f154d67f670f428f6aea06b9d20e49ae009fec4faa5fc8ec027d38280

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:06 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
/
0211c812.akstat.io/
0
354 B
XHR
General
Full URL
https://0211c812.akstat.io/?h.pg=article&when=1568923687497&t_other=custom4%7C289&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=04d714d23f5169c1897ed805de51b47e4910d6fe&h.t=1568923687178&http.initiator=api&rt.start=api&rt.si=bcddb532-3361-466b-8e12-8f400233dc7d&rt.ss=1568923688170&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:07 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 19 Sep 2019 20:08:07 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=46250790873254166583037357462225766239&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=AVID%012EC1F01385158000-400868C6800E8930&ts=1568923687537
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.161.170 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-161-170.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cce60b66869b45065bbea45a8225547dd9d13874446fef0a0f56c712ef56ad57

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v042-035e609da.edge-irl1.demdex.com 5.59.0.20190904135845 17ms (+1ms)
Pragma
no-cache
Content-Encoding
gzip
X-TID
bBXUG/coTVw=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
672
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s03204208316782
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s03204208316782?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=19%2F8%2F2019%2022%3A8%3A7%204%20-120&d.&nsid=0&jsonv=1&.d&mid=46250790873254166583037357462225766239&aid=2EC1F01385158000-400868C6800E8930&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=mongodb&c2=D%3Dv2&v2=uk&l2=113c25b6-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=623cb559-47fd-413f-b0d7-c357b8460777&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=8469d8da-6f0f-46c7-b073-0b55149c0e08&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=BdOybV2D4CfcGLXVlEs&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=false&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.49.100.189 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-49-100-189.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1e738ee52cc1b803eba38988922c9a8b04fc1d25418ff4b6b7d0ef6d6018f3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-aam-tid
t8Ck42BZRpM=
date
Thu, 19 Sep 2019 20:08:07 GMT
x-content-type-options
nosniff
x-c
master-983.I1f9e38.M0-267
p3p
CP="This is not a P3P policy"
status
200
content-length
1597
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-v042-0cbc82610.edge-irl1.demdex.com 5.59.0.20190904135845 11ms (+1ms)
pragma
no-cache
last-modified
Fri, 20 Sep 2019 20:08:07 GMT
server
jag
xserver
anedge-76fc945c4d-d64z9
etag
2EC1F01385158000-401D6647600E5BD0
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Wed, 18 Sep 2019 20:08:07 GMT
cygnus
as-sec.casalemedia.com/
66 B
943 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A63691448%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22563afc66-7b93-4f69-b9ae-7b788a29a9ce%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-09-19T20%3A08%3A07%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1dbebf988c786659a862c8243be541462c85ada4815b5f35d7219f759bac36f0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Thu, 19 Sep 2019 20:08:09 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=J6ytSGRJ&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
65e6b5b282d5a23a0f1e6f8860d5b3258a249e3c23dd906b41ef193950dd0799
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
X-Proxy-Origin
77.243.177.40; 77.243.177.40; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.249:80
AN-X-Request-Uuid
dc310e9a-deee-45bd-b786-272e170095d6
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=FIg9Y7Zh&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
09ffd1768bcceddb2860df0b2004a6e6fb19b335e2cd72e20af3b4c3464b3411
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
X-Proxy-Origin
77.243.177.40; 77.243.177.40; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.171:80
AN-X-Request-Uuid
e7975b56-28c1-47aa-bf0b-7112a58c5b6a
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=rCRNxw2j&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
bdb714e5520dfb6840b8e3684b581a81f7a89c24059ec31f28c7e9e3cc5eca76
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
X-Proxy-Origin
77.243.177.40; 77.243.177.40; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.43:80
AN-X-Request-Uuid
ce1aa2ea-1c72-4020-8638-61b82c779f96
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=BdteHEjg&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
5c3b61444760e8bfdb8b13c818cfba99992feb0b0ff796f49bef2caffaab30e2
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
X-Proxy-Origin
77.243.177.40; 77.243.177.40; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.245:80
AN-X-Request-Uuid
f6119d42-cd12-46a0-8121-196f3ffc5440
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=rvgJ4htV&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
24c28b5d6fde57af21dbaf889a64d41aa543cf8b898b4e1fea3e24696051bfcc
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
X-Proxy-Origin
77.243.177.40; 77.243.177.40; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.117:80
AN-X-Request-Uuid
5fce6321-bc14-4cf8-8b3d-1aa5dc3518a0
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
cf-cache-status
HIT
age
262358
cf-ray
518e30a3ec058caa-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 19 Sep 2019 20:38:09 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D39) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECAcc (lha/8D39)
etag
"1112944691+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Fri, 04 Oct 2019 20:08:09 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
994 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C8C) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8C8C)
etag
"461771432"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Fri, 04 Oct 2019 20:08:09 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1022 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C8B) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8C8B)
etag
"4198895974"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Fri, 04 Oct 2019 20:08:09 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DB7) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECAcc (lha/8DB7)
etag
"931235332+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Fri, 04 Oct 2019 20:08:09 GMT
utag.1810.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D07) /
Resource Hash
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
last-modified
Mon, 08 Jul 2019 17:22:10 GMT
server
ECAcc (lha/8D07)
etag
"4274102907"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
988
expires
Fri, 04 Oct 2019 20:08:09 GMT
pixel_details.html
www.everestjs.net/static/ Frame 7E1A
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.39.101.26 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-39-101-26.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=38334
Expires
Fri, 20 Sep 2019 06:47:03 GMT
Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Length
146
Connection
keep-alive

Redirect headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Server
Apache
Set-Cookie
everest_session_v2=XYPgKQAABO5Uk5aZ; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XYPgKQAABO5Uk5aZ; path=/; domain=.everesttech.net; expires=Sat, 14-Aug-2021 06:48:09 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XYPgKQAABO5Uk5aZ&gsurfer=XYPgKQAABO5Uk5aZ&optout=0&throttleCookie=&time=20190919200809
Content-Length
345
Keep-Alive
timeout=15, max=993863
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Cookie set dest5.html
cbsi.demdex.net/ Frame C7A8
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.119.187 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-50-119-187.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=46454961277536362663058320685457900071; dextp=269-1-1568923687546|477-1-1568923687646|771-1-1568923687747|22052-1-1568923687849|30646-1-1568923687949|121998-1-1568923688050|127444-1-1568923688151
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Tue, 10 Sep 2019 14:27:42 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=46454961277536362663058320685457900071;Path=/;Domain=.demdex.net;Expires=Tue, 17-Mar-2020 20:08:09 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
M1QTCigaQIk=
Content-Length
2764
Connection
keep-alive
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1926626353ac16192616b413195f159e36ff2c55495f075c39a94f43d0ff9cea
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
491
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 19 Sep 2019 20:04:23 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:09 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
f778846e-bd0e-45cf-a640-35ac76b00f0b
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 19 Sep 2019 21:34:23 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/
406 B
421 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
536181
status
200
vary
Accept-Encoding
content-length
270
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7a1c4a-196"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Sep 2019 15:11:47 GMT
gootkit-collections.png
zdnet2.cbsistatic.com/hub/i/r/2019/09/17/ddf4c743-fae1-4f16-b3b8-8a22754e09cd/resize/270xauto/71bd787d234086d64a14cdee63d37037/
26 KB
25 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/17/ddf4c743-fae1-4f16-b3b8-8a22754e09cd/resize/270xauto/71bd787d234086d64a14cdee63d37037/gootkit-collections.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f7d4d75c81551cd3ecbd65c7e01cc7637e34bc1bce0efee4d5cf22c28e87e4da
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
155342
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
25852
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"26324d8e2cc1957b8e581568a089a51c"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gootkit-luhnforms.png
zdnet4.cbsistatic.com/hub/i/2019/09/17/00e8f035-3f7c-4258-8aff-f50cdaeded4d/526600ef820fcd9bdcb5db4a7198f8df/
17 KB
16 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/2019/09/17/00e8f035-3f7c-4258-8aff-f50cdaeded4d/526600ef820fcd9bdcb5db4a7198f8df/gootkit-luhnforms.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d8064cf1525cfe6cd379de0ad85a89fa9d4d5bd46ffdae557d90b5935bedc40f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198448
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
16630
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"74a14dc6be3d469770f53dd3fb93c6c4"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gootkit-credentials.png
zdnet3.cbsistatic.com/hub/i/2019/09/17/5bc1d721-d4a3-47d6-a3fd-5e27e684037c/4a7e315a75252dd95496bf1711f36a06/
8 KB
8 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/2019/09/17/5bc1d721-d4a3-47d6-a3fd-5e27e684037c/4a7e315a75252dd95496bf1711f36a06/gootkit-credentials.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
890da84f91eaaef3193974ab2314bae84ba94da64b702a61bc427a48799baa5d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198447
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
8032
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c404a5adbf90e09631678b13b05d9d7a"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gootkit-indexes.png
zdnet4.cbsistatic.com/hub/i/r/2019/09/17/680ff10a-746d-40bb-905a-69b031852438/resize/270xauto/065309c511b20481c392cca352bd2b3d/
110 KB
101 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/17/680ff10a-746d-40bb-905a-69b031852438/resize/270xauto/065309c511b20481c392cca352bd2b3d/gootkit-indexes.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6a6912a2b7c9f99f608d4a6f223e93b47a1b5a5e961000ccd4e8100ff1be19b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
196490
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
103647
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"0559006cc4d259d01366e6cc566989b4"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
image-gallery-modal-e49526b449-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
302077
status
200
vary
Accept-Encoding
content-length
1909
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4a-13d0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 23 Sep 2019 08:13:31 GMT
09-rsync.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/
26 KB
26 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/09-rsync.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4747617
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
26578
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"389c96d539ed67bd670f0a32d9765469"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
10-couchdb.png
zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/
26 KB
26 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/10-couchdb.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
165367
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
26710
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"3af65294001defdf7d60d4b9e3151fff"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
12-etcd.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/
30 KB
30 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/12-etcd.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3261457
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
30537
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c754f5d09de891bf9429e3a39af69ab6"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
13-firebase.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/
25 KB
25 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/13-firebase.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4747618
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
25563
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"4490759a6b69ecb7c170d8e1476be569"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
14-jira.png
zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/
28 KB
28 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/14-jira.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4757713
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
29043
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"24f1f625bd45de40d754ee728086e4dc"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
disqus-loader-db6fae9369-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
865 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
311211
status
200
vary
Accept-Encoding
content-length
642
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4a-580"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 23 Sep 2019 05:41:17 GMT
chrome-ui-customizer.png
zdnet2.cbsistatic.com/hub/i/r/2019/09/19/8deab5f0-86e5-447c-8bdc-3db634cd24ff/thumbnail/70x53/90c34af20a203822769c22d72b664648/
6 KB
6 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/19/8deab5f0-86e5-447c-8bdc-3db634cd24ff/thumbnail/70x53/90c34af20a203822769c22d72b664648/chrome-ui-customizer.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eabf02dafea4d62b8ddf7e834712aca0cbd9e3207216c63ae56899ee4f66b0c2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11260
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5595
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"af87f7cdcda223c41c3f3ef05a3aaeea"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ethereum.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/12/11/b238c673-98ce-4cec-bfde-69be7b63e00c/thumbnail/70x53/98d7c2a52734f762a090e39f540dfde1/
2 KB
2 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/12/11/b238c673-98ce-4cec-bfde-69be7b63e00c/thumbnail/70x53/98d7c2a52734f762a090e39f540dfde1/ethereum.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
efd40f332a97e62c2e29d6ce9f98dc7b52488333cadd7498df77de6b97b0989f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11440
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1642
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a40511cad8383e5ae8ddd8b855d135da"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ubisoft.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/70x53/4f2f76260471bee343edf61ca8e0b843/
2 KB
2 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/70x53/4f2f76260471bee343edf61ca8e0b843/ubisoft.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f29a0dc63fd89192d786b1a283c9683155574c621afb42e9eff2845ff036a93b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71027
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1529
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"aff0a6a4521232970b2c1cf539ad0a19"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
php.png
zdnet1.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/70x53/2e9e23da728cad4cbd70316ce39ec4aa/
1 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/70x53/2e9e23da728cad4cbd70316ce39ec4aa/php.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b5817995fc826ef80ea5b3fa55c849f3b25d6183e155beea335726a7fb3f93da
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77744
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1292
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b5488aeff42889188d03c9895255cecc"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a46efac6cae6129da9f72c7d34a7f9c5d8bf39bf927984395e16405affab0302
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
731
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:10 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
765807b1-b1a2-44e1-82cf-5a7f5cccdcaa
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Thu, 19 Sep 2019 20:08:10 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/
11 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ebbd7cae48601e61f827f5eb6510a679ed56d12c7dc8a305d53821c70273aeff
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1747
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:10 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
517124d6-a431-4471-ad50-cdacfc4342d0
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Thu, 19 Sep 2019 20:08:10 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
539317
status
200
vary
Accept-Encoding
content-length
1564
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4a-124a"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Sep 2019 14:19:32 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
1008 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
172509
status
200
vary
Accept-Encoding
content-length
827
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:26:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7fb7ca-514"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 24 Sep 2019 20:12:59 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
103 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
x-content-type-options
nosniff
age
133036
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:27:08 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7fb7dc-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 07:10:53 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
84 KB
19 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c8a470e3401a22d53d3d819af1c0427d46961c74128addcc4cfe546c9ae8d1e0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hZ.s1pHkZ14IoPLHxhRD_FfeAL4cHOAs
content-encoding
gzip
etag
"a5154b31067b06b17ece09974ec52972"
age
23
x-cache
HIT
status
200
content-length
18764
x-amz-id-2
0UQDvA5XzTBBRHdRYnXtGIxvVSFRU6iHonhJOLd3NxAG3QaQso6yOsEb/7Y46xfvbCM/8K6N+Ls=
x-served-by
cache-hhn4057-HHN
last-modified
Thu, 19 Sep 2019 10:12:50 GMT
server
AmazonS3
x-timer
S1568923690.752307,VS0,VE1
date
Thu, 19 Sep 2019 20:08:09 GMT
vary
Accept-Encoding
x-amz-request-id
E0F25DDBBDB186C2
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
57
x-cache-hits
1
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
60 KB
15 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
661582515dd231f99fdd37d11c1237a8e001ab99b898dc1430ac2f73f718098c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
242427
cf-polished
origSize=62037
status
200
edge-control
max-age=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"f255-UCA7wINInts3OI0TBl6iZ+HnnBg"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=60, s-maxage=604800
cf-ray
518e30a4c9996aa7-LHR
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cbs_zQTp2H_zdnet.js
cdn-magiclinks.trackonomics.net/client/static/v2/
95 KB
18 KB
Script
General
Full URL
https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:3a00:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 17:32:12 GMT
content-encoding
gzip
last-modified
Wed, 21 Aug 2019 10:15:58 GMT
server
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age
9357
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
x-amz-cf-pop
FRA56
access-control-allow-origin
*
x-amz-cf-id
q9WjQyvOt8tME6ngZg4Fa5Wo3zFOAkXrAp9ogt_ojWvfRK8_ib3mbg==
via
1.1 a84a4d90dd581e1a1c18e1bf5992b931.cloudfront.net (CloudFront)
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.148.23 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-148-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Sun, 22 Sep 2019 20:08:09 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.148.23 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-148-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:09 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568923689677&ns_c=UTF-8&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&c9=
Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:09 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rn...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rn...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rnd=1568923689678&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.253.244 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-253-244.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:09 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:09 GMT
server
nginx
status
302
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/&rp=&ts=compact&rnd=1568923689678&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
121 KB
31 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31604
x-xss-protection
0
pragma
public
x-fb-debug
B56muq0pqtEgWmUFZdRhgjpVkcoaK3wRfaAh7jR7yrxhQPxNWLhpidJDYtVBHlfcnzYlC5yPfGw/7+TQyd8IXg==
x-fb-trip-id
420120009
x-frame-options
DENY
date
Thu, 19 Sep 2019 20:08:09 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
gootkit-collections.png
zdnet2.cbsistatic.com/hub/i/r/2019/09/17/ddf4c743-fae1-4f16-b3b8-8a22754e09cd/resize/270xauto/71bd787d234086d64a14cdee63d37037/
26 KB
26 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/17/ddf4c743-fae1-4f16-b3b8-8a22754e09cd/resize/270xauto/71bd787d234086d64a14cdee63d37037/gootkit-collections.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f7d4d75c81551cd3ecbd65c7e01cc7637e34bc1bce0efee4d5cf22c28e87e4da
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
155342
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
25852
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"26324d8e2cc1957b8e581568a089a51c"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gootkit-luhnforms.png
zdnet4.cbsistatic.com/hub/i/2019/09/17/00e8f035-3f7c-4258-8aff-f50cdaeded4d/526600ef820fcd9bdcb5db4a7198f8df/
17 KB
16 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/2019/09/17/00e8f035-3f7c-4258-8aff-f50cdaeded4d/526600ef820fcd9bdcb5db4a7198f8df/gootkit-luhnforms.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d8064cf1525cfe6cd379de0ad85a89fa9d4d5bd46ffdae557d90b5935bedc40f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198448
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
16630
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"74a14dc6be3d469770f53dd3fb93c6c4"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gootkit-credentials.png
zdnet3.cbsistatic.com/hub/i/2019/09/17/5bc1d721-d4a3-47d6-a3fd-5e27e684037c/4a7e315a75252dd95496bf1711f36a06/
8 KB
8 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/2019/09/17/5bc1d721-d4a3-47d6-a3fd-5e27e684037c/4a7e315a75252dd95496bf1711f36a06/gootkit-credentials.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
890da84f91eaaef3193974ab2314bae84ba94da64b702a61bc427a48799baa5d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198447
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
8032
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c404a5adbf90e09631678b13b05d9d7a"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ethereum.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/12/11/b238c673-98ce-4cec-bfde-69be7b63e00c/thumbnail/70x53/98d7c2a52734f762a090e39f540dfde1/
2 KB
2 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/12/11/b238c673-98ce-4cec-bfde-69be7b63e00c/thumbnail/70x53/98d7c2a52734f762a090e39f540dfde1/ethereum.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
efd40f332a97e62c2e29d6ce9f98dc7b52488333cadd7498df77de6b97b0989f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11440
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1642
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a40511cad8383e5ae8ddd8b855d135da"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ubisoft.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/70x53/4f2f76260471bee343edf61ca8e0b843/
2 KB
2 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/19/63ac0ec3-7744-4b0d-b332-cf07b0953794/thumbnail/70x53/4f2f76260471bee343edf61ca8e0b843/ubisoft.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f29a0dc63fd89192d786b1a283c9683155574c621afb42e9eff2845ff036a93b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71027
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1529
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"aff0a6a4521232970b2c1cf539ad0a19"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
chrome-ui-customizer.png
zdnet2.cbsistatic.com/hub/i/r/2019/09/19/8deab5f0-86e5-447c-8bdc-3db634cd24ff/thumbnail/70x53/90c34af20a203822769c22d72b664648/
6 KB
6 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/19/8deab5f0-86e5-447c-8bdc-3db634cd24ff/thumbnail/70x53/90c34af20a203822769c22d72b664648/chrome-ui-customizer.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eabf02dafea4d62b8ddf7e834712aca0cbd9e3207216c63ae56899ee4f66b0c2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11260
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5595
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"af87f7cdcda223c41c3f3ef05a3aaeea"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
php.png
zdnet1.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/70x53/2e9e23da728cad4cbd70316ce39ec4aa/
1 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/10/14/8cb090a5-da9d-47c8-b769-e1a9692a5c62/thumbnail/70x53/2e9e23da728cad4cbd70316ce39ec4aa/php.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b5817995fc826ef80ea5b3fa55c849f3b25d6183e155beea335726a7fb3f93da
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77744
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1292
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b5488aeff42889188d03c9895255cecc"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/
882 B
639 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
308762
status
200
vary
Accept-Encoding
content-length
460
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7a1c4a-372"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 23 Sep 2019 06:22:07 GMT
gootkit-indexes.png
zdnet4.cbsistatic.com/hub/i/r/2019/09/17/680ff10a-746d-40bb-905a-69b031852438/resize/270xauto/065309c511b20481c392cca352bd2b3d/
110 KB
101 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/17/680ff10a-746d-40bb-905a-69b031852438/resize/270xauto/065309c511b20481c392cca352bd2b3d/gootkit-indexes.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6a6912a2b7c9f99f608d4a6f223e93b47a1b5a5e961000ccd4e8100ff1be19b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
196490
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
103647
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"0559006cc4d259d01366e6cc566989b4"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
151.208.227.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:07:40 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1556302399
age
29
x-guploader-uploadid
AEnB2UrWOpbTMCCfyucfHlw6XWgPAXPcH6dr8AsbpjQ3Nhsxt4ibWwohcOPRl9OLeJzB6ZTuc-qI4m7JJmqAeITAf-r3jD0LNw
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16960
last-modified
Fri, 26 Apr 2019 18:13:21 GMT
server
UploadServer
etag
"251defdc0ecc8a3bad8ae4cf9aab1923"
vary
Accept-Encoding
x-goog-hash
crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation
1556302401249893
cache-control
public, max-age=300
x-goog-stored-content-length
16960
accept-ranges
bytes
content-type
application/javascript
expires
Thu, 19 Sep 2019 20:12:40 GMT
309391486091569
connect.facebook.net/signals/config/
307 KB
78 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.9.4&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
79752
x-xss-protection
0
pragma
public
x-fb-debug
3VV74VdDRPFbMk51CvTSrIpmlNAKKoAHlof3F/g5wfYnf8J2AfEptle18uvl9h4g/UFy4SPNleG1o1T/KiMZbw==
x-fb-trip-id
420120009
x-frame-options
DENY
date
Thu, 19 Sep 2019 20:08:09 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/
2 KB
835 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
36021
status
200
vary
Accept-Encoding
content-length
710
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:28:43 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d82856b-7a5"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Sep 2019 10:07:46 GMT
count.js
zdnet-1.disqus.com/
0
0

/
684dd306.akstat.io/
0
354 B
Other
General
Full URL
https://684dd306.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 19 Sep 2019 20:08:10 GMT
inferredEvents.js
connect.facebook.net/signals/plugins/
35 KB
10 KB
Script
General
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
10218
x-xss-protection
0
pragma
public
x-fb-debug
0DTCyBwY1xNosk//1A/iJBdzeVnfy8NApySygJnWYlHaMpvMDvgiPxeLcWHVNDaa79hNJ1bAFSKMtTDaR0YOUA==
x-fb-trip-id
420120009
x-frame-options
DENY
date
Thu, 19 Sep 2019 20:08:09 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
4083-12969.js
www.everestjs.net/dl/4083/
484 B
664 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.39.101.26 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-39-101-26.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=39305
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Fri, 20 Sep 2019 07:03:14 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=996544
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFlQZ0tRQUFCTzVVazVhWg
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEAWOxyuPPeqab-xfjkubMw8&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=996516
Content-Length
128

Redirect headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
/
www.facebook.com/tr/
44 B
247 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&rl=&if=false&ts=1568923689767&sw=1600&sh=1200&v=2.9.4&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1568923689766.837794883&it=1568923689716&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Thu, 19 Sep 2019 20:08:09 GMT
bcn
www.summerhamster.com/
43 B
181 B
Image
General
Full URL
https://www.summerhamster.com/bcn?fe=1568923689782&y=2.0.1105&elg=496318553&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fjrrwnlw-pdozduh-fuhz-ohiw-wkhlu-gdwdedvh-hasrvhg-rqolqh-zlwkrxw-d-sdvvzrug%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fzzcgsaakv%2F%3Brug%3D1568923686630%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.28.51.75 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-28-51-75.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 19 Sep 2019 20:08:09 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.148.23 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-148-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
901
Expires
Fri, 20 Sep 2019 20:08:09 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
etag
"fc0de48a0976cde02ddee0bd49a81832"
age
253
x-cache
HIT, HIT
status
200
content-length
4742
x-amz-id-2
yrT/u9Rv6PktLWJG8mTKM8SDKOdGK7Nt6385N2MlaVIkQyZbpbyDvzQSaL/jT+h2dF8WPMkVNrQ=
x-served-by
cache-lax8651-LAX, cache-hhn4028-HHN
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1568923690.883942,VS0,VE147
date
Thu, 19 Sep 2019 20:08:10 GMT
vary
Accept-Encoding,,
x-amz-request-id
BF8556B9B88B5C74
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
101, 1
impl.20190919-3-RELEASE.js
cdn.taboola.com/libtrc/
393 KB
111 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20190919-3-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
396bf68eca1ce17182ad5a282b4eac1039766aabac1d446c8b457d558a8ca249

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
tg6nSHAJNQA6B09s2qWnwgL1oNur7gsT
content-encoding
gzip
etag
"56e1ff0c4b5f21984579482845c70023"
age
26284
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
113787
x-amz-id-2
3agKRzMahHQfiGQuceSRmeCG9fqhb8wDDPLkrGyzIN1wOQF98fFROatlDcnRcBVingXrsu6ruGI=
x-served-by
cache-hhn4057-HHN
last-modified
Thu, 19 Sep 2019 12:50:02 GMT
server
AmazonS3
x-timer
S1568923690.814852,VS0,VE0
date
Thu, 19 Sep 2019 20:08:09 GMT
vary
Accept-Encoding
x-amz-request-id
99121236B4B94CE4
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
50
x-cache-hits
257558
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=KeCDXbXfMoKg3w...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358&ipr=y
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1511444586&crd=&is_vtc=1&random=1414731358&ipr=y
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
341 B
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:833::4000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=996538
Content-Length
128
ads
securepubads.g.doubleclick.net/gampad/
168 KB
40 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2942376395149128&correlator=177507562791155&output=ldjh&impl=fifs&adsid=NT&json_a=1&eid=21064578%2C21062415%2C21062724%2C21064580%2C21064592&vrg=2019091201&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190919&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C320x50%7C11x11%2C300x250%2C300x250%2C641x321%2C728x90%7C970x66%7C970x250%2C371x771&fluid=0%2C0%2C0%2C0%2Cheight%2C0%2C0%2C0%2C0%2C0&ists=256&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dtop%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cservers%26tag%3Dmalware%252Ctarget%26mfr%3Dmongodb%26prodtype%3Dcards%252Ccomputers%252Ccomputer%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dgootkit-malware-crew-left-their-database-exposed-online-without-a-password%26env%3Dprod%26firstpg%3D1%26vguid%3D623cb559-47fd-413f-b0d7-c357b8460777%26session%3Dh%26subses%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1568917629&dt=1568923689865&dlt=1568923686151&idt=673&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C208%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C1613%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=174425173%2C2516391292%2C1364810931%2C1335650094%2C1597096659%2C2407337712%2C1261997479%2C1028884501%2C1541325764%2C1598186610&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&dssz=91&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x7271%7C1585x0%7C1585x0%7C370x0%7C770x11%7C370x0%7C370x250%7C770x6203%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C770x11%7C300x280%7C300x280%7C641x361%7C728x130%7C371x771&ga_vid=116664063.1568923690&ga_sid=1568923690&ga_hid=1865222649&fws=132%2C4%2C132%2C132%2C4%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
0d4c63acf1883cc67df48a08701d832f58db2640bc374979793dcde9f41cd6c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
40619
x-xss-protection
0
google-lineitem-id
4745699004,-2,5160351794,4870674433,5050413510,4871469974,4871469974,4745327422,4871469974,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138245072116,-2,138285768966,378485649091,138273985938,378544055252,378544055252,138239368367,378487991023,138247024569
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019091201.js
securepubads.g.doubleclick.net/gpt/
62 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
7c92ffc225aed56f82019862b155c8d84902352620250d029bbf653a3d7eab61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 12 Sep 2019 13:06:13 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
24116
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:09 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

headerstats
as-sec.casalemedia.com/
0
337 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 19 Sep 2019 20:08:10 GMT
b
sb.scorecardresearch.com/
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1568923689998&ns_c=UTF-8&cv=3.1&c8=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.148.23 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-148-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
etag
"da73fb2066df9f51d08b6688cfb35441"
age
28628104
x-cache
HIT, HIT
status
200
content-length
91236
x-amz-id-2
T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by
cache-lax8632-LAX, cache-hhn4028-HHN
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1568923690.064534,VS0,VE0
date
Thu, 19 Sep 2019 20:08:10 GMT
vary
Accept-Encoding,,
x-amz-request-id
58FF20717A687DE4
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
text/javascript
x-cache-hits
1694, 21
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
5077
date
Thu, 19 Sep 2019 18:43:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17803
expires
Thu, 19 Sep 2019 20:43:33 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.148.23 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-148-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Fri, 20 Sep 2019 20:08:10 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame B4F3
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Thu, 19 Sep 2019 20:08:10 GMT
via
1.1 varnish
x-served-by
cache-hhn4028-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1568923690.169846,VS0,VE0
content-length
0
collect
www.google-analytics.com/r/
35 B
111 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1865222649&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&ul=en-us&de=UTF-8&dt=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=1474989029&gjid=1053272932&cid=116664063.1568923690&tid=UA-33613588-22&_gid=1397167230.1568923690&_r=1&cd2=other&z=1570175840
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
cf-cache-status
HIT
age
262359
cf-ray
518e30a7b81e8caa-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 19 Sep 2019 20:38:10 GMT
0.8343532800138947
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
223 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.8343532800138947?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=gootkit+malware+crew+left+their+database+exposed+online+without+a+password&v22=content_article&v23=&v24=623cb559-47fd-413f-b0d7-c357b8460777&v30=8469d8da-6f0f-46c7-b073-0b55149c0e08&v60=33167647,33165561,33165221&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201909190-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.49.100.189 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-49-100-189.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:09 GMT
x-content-type-options
nosniff
x-c
master-983.I1f9e38.M0-267
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 20 Sep 2019 20:08:10 GMT
server
jag
xserver
anedge-76fc945c4d-hwjkt
etag
2EC1F0157FFF8000-40101FF1C00E8282
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Wed, 18 Sep 2019 20:08:10 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=8469d8da-6f0f-46c7-b073-0b55149c0e08&assettitle=gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password&assettype=content_article&pubdate=2019-09-17%2013%3A00%3A00&viewguid=623cb559-47fd-413f-b0d7-c357b8460777&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=8469d8da-6f0f-46c7-b073-0b55149c0e08&v16=623cb559-47fd-413f-b0d7-c357b8460777&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1568923690193&tcset=utf8&im=dsjs&title=Gootkit%20malware%20crew%20left%20their%20database%20exposed%20online%20without%20a%20password%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=848
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
/
www.facebook.com/tr/ Frame 7791
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
4804
pragma
no-cache
cache-control
no-cache
origin
https://www.zdnet.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
cookie
fr=0mu167eW9IGX7qlds..Bdg-Ap...1.0.Bdg-Ap.
Origin
https://www.zdnet.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-length
0
server
proxygen-bolt
date
Thu, 19 Sep 2019 20:08:10 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 2281
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Thu, 19 Sep 2019 20:08:10 GMT
via
1.1 varnish
x-served-by
cache-hhn4028-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1568923690.424001,VS0,VE0
content-length
0
domains
api.viglink.com/api/
42 B
487 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
a0118eb45f9fe5d319f81d27b2897b0f488c7c6904a8aa7a18b718505f04efc1

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 4155
0
75 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss8ud_e62LRZTzmkOQkQPoTwfbqu4zLl-mkQYH_8bHNuvRFesvN0qqJx5GMDaTQ8562W8_GpLPg_fz0ll0e2rgR5UNtcpOwr83ZsEX8687Y1bU65OWFP78PjeDbgmmWhWHZhkYy7wFrcPqo4-k63YrOmnmZyvZ8D4AdyxJQ4nlgzUbLxFd4U3TOI_stVGUZv_A7TR1GgccCkYwzO2zFH3l9Lij1t4J4QHD-Wm0C9ep7L-uHjaoEByakKirpAX3ZHTCVfWznazTj&sig=Cg0ArKJSzAieTVLZZpwzEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 4155
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 4155
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25351
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
41ad8ff7e5205f7360535566ad386abb370abb9b92af19005a7ded4a803faf28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29138
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9BA0
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmwBQE0YNFPW2actNaAvAYOTS6ZttLN9B47ykJtqmg64mb2f1_Woa27V2ghlo_91WI133hL678iMJk0kZVMF6iI9E4CboX7hONxT7p2SKwI5NZ5hIphSjU7sizvzadbKOGUmY-FbeZV3tFWwaMBvCQtiprl1TyOTlZgLfou4g-tvKakdczfFArjldJ9uDScqQElffyiaegXQiM1V0dpO6V8pv3CdKB2gVMi7_iLmG8kmb4u5wSxIo5KsIfvUpu2EHd9Tv6HQkNZQ&sig=Cg0ArKJSzEo9uWIIgAmdEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
dcmads.js
www.googletagservices.com/dcm/ Frame 9BA0
4 KB
2 KB
Script
General
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4cbbded69e58ffd516843ca83e654d18df040daa36e54f40daf4b756f52e853b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 19:26:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 16:06:32 GMT
server
sffe
age
2519
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
2037
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:26:11 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 9BA0
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 9BA0
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25351
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 8D10
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Thu, 19 Sep 2019 19:08:32 GMT
expires
Fri, 18 Sep 2020 19:08:32 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3578
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
view
securepubads.g.doubleclick.net/pcs/ Frame C3E3
0
48 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdEB4livscg9QDb44Yh0M_FE6Zb8aMlHQA-l1TO6AchzQGbqs_fbKEqAj5vSsdTcrILg4wVVF-V9yPrkmAKw7bOfSyDUCwM5neLIhGLZIMYHmhRZYrJ7YEunFb2UwnOzoQcKf7Ih45Wn90RBmbWTmO_MSl2rai5IQcMqkopmHp-bySZt05Sz69u-3gnUlP4LTOj_6ZCJGwe2K-J3O3sSMwBbERzJh8Sq2zH7YEkxLW1X1P9-Ei-6CKmS1OsUuQNoPhN_9QMZKOcg&sig=Cg0ArKJSzB2E1zmwewBdEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
B22814289.249203913;dc_pre=CLm5iJrY3eQCFZi43god22YPrA;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/ Frame C3E3
Redirect Chain
  • https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=?
  • https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_pre=CLm5iJrY3eQCFZi43god22YPrA;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_chi...
43 B
110 B
Fetch
General
Full URL
https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_pre=CLm5iJrY3eQCFZi43god22YPrA;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f6.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
content-type
text/html; charset=UTF-8
location
https://ad.doubleclick.net/ddm/trackimp/N6580.148013.CNET/B22814289.249203913;dc_pre=CLm5iJrY3eQCFZi43god22YPrA;dc_trk_aid=445387738;dc_trk_cid=117597040;ord=1179211769;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=?
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sfp-set-targeting.js
native.sharethrough.com/assets/ Frame C3E3
24 KB
9 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp-set-targeting.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.218.158 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-218-158.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
742e8a8058ca031723c29ca0b042360d95c26c8d4f53621165639b9d83142890

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 18:14:16 GMT
content-encoding
gzip
last-modified
Thu, 19 Sep 2019 16:27:46 GMT
server
AmazonS3
age
3192
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-pop
FRA56
x-amz-cf-id
Gvbd84ZoMkN1jwEGeqHT-BMD3soiIujDEDHs3yaff47vkwfMlEG1Zw==
via
1.1 bab68affea15bbe0bb14b61f027cc282.cloudfront.net (CloudFront)
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C3E3
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame C3E3
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25351
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 1935
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Thu, 19 Sep 2019 19:08:32 GMT
expires
Fri, 18 Sep 2020 19:08:32 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3578
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 0A16
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Thu, 19 Sep 2019 19:08:32 GMT
expires
Fri, 18 Sep 2020 19:08:32 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3578
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
view
securepubads.g.doubleclick.net/pcs/ Frame 55E2
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuaYb8CdDZzwFMucZVClr9y-EAMsjjJGBfrdFkddqu_CZetA0kDTEHR7TzszzM24ABBjukJo8dFV-MKPeObA89SKZgZVDjc3dwbsBrwzvMTopBTOORjJcK3E8WXRVLLIB89gPHNdNHd3pV8zWysjSkB8kv8bpGmPkHfzZGkcbeskfI69GvD4sgmSFwwzQ3GpHzjCRWFuaKHN1_6aPu8zvq8_yx5vhD74N2FmcyO1HBZcSiNKM-ZQ2bTwjh2LxcA_jJGJHh9CCy-&sig=Cg0ArKJSzLXxjXMQ0681EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 55E2
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 55E2
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25351
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame FF77
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Thu, 19 Sep 2019 19:08:32 GMT
expires
Fri, 18 Sep 2020 19:08:32 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3578
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
view
securepubads.g.doubleclick.net/pcs/ Frame 2247
0
48 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuREhcHAcdp5n_zmHvhGw-VXIlrEFxTlzBPTjMfuDPJ8e1uojaf6ZHNVqqfBlc3Ux2vD8qYTJBLfWWJRPzz0uawRcDOLp4Hy4XtiAKxuuUpLCrvH1Q5rO1k_Xe10lqQD7-JNptCbP7Dn6rUflLjf9-ZLDVUWR1kKHirJa8dSJ5V1DrpCWpw2lo-nsXtNO1b0O0gDvzIkAfiLPvifc-pcnxjzDf8a-L--PqUU7PQKkz-ukYQiNBIdJ2OywQMXuGMPbugX0gcn7oS&sig=Cg0ArKJSzL0hLA0aBhb6EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:10 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
adKit.min.js
rev.cbsi.com/common/js/ Frame 2247
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?2080902467
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.224.248 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-224-248.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 May 2019 18:29:20 GMT
Server
Apache
ETag
"e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2149
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2247
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2247
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js?21064578
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25351
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
impl_v52.js
www.googletagservices.com/dcm/ Frame 9BA0
22 KB
9 KB
Script
General
Full URL
https://www.googletagservices.com/dcm/impl_v52.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5f4147d470235edc4e770d186e5abddbafd1ae66fcecd03eaddc751fcbd782ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 06:26:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 26 Aug 2019 14:39:55 GMT
server
sffe
age
49284
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
9536
x-xss-protection
0
expires
Fri, 18 Sep 2020 06:26:46 GMT
B22848860.249063861;dc_ver=52.141;sz=970x250;u_sd=1;dc_adk=1069275668;ord=qsmbik;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssRtB6hHtpI9RyH93oGbxye3mm3nUlfHDPhy1rYlgIN...
ad.doubleclick.net/ddm/adj/N410401.281526ZDNET/ Frame 9BA0
12 KB
8 KB
Script
General
Full URL
https://ad.doubleclick.net/ddm/adj/N410401.281526ZDNET/B22848860.249063861;dc_ver=52.141;sz=970x250;u_sd=1;dc_adk=1069275668;ord=qsmbik;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssRtB6hHtpI9RyH93oGbxye3mm3nUlfHDPhy1rYlgIN4QB2EUQzKMxKnht07XqbreUU7nbeDKA-e0F9-P5SgA1ZJQ5XgWlIQJojfaevJ1xAbHVy458C8CvI1KEUcTviecTT2ozYZxbKLCNapTfx_EfWJ03oQOEEFCQgwhXzLTVD0FBy2khN6OOb0jjMA4TylgZHMUDXqrvicZIokrStTYUCmeDgpX-OpkTTaIcELiFilQZ-udCunNZEPeUj5ViubuRZEkFLfA%26sig%3DCg0ArKJSzO5l31_d5j0VEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F$0;xdt=0;crlt=MZDmMb4)X-;osda=2;sttr=79;prcl=s?
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v52.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f6.1e100.net
Software
cafe /
Resource Hash
2cf3745c81122542ed6598c484233ce3a5b8eac99426c128cd656fa1ff4b0dc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
7661
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame C3E3
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0799a9473132c6e88f2fb5a84d31c7e3759f3687bba3b6f499671522eb0b50e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
tag.aspx
ml314.com/ Frame 4155
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1982019
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:09 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 04:20:41 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=29550
Connection
keep-alive
Content-Length
11933
Expires
Fri, 20 Sep 2019 04:20:41 GMT
n.js
geo.moatads.com/ Frame 4155
106 B
364 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=16&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690785&de=642813573859&m=0&ar=ab397f9-clean&q=2&cb=0&ym=0&cu=1568923690785&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=741594489&cs=0&callback=MoatSuperV26.gna86689
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
bfb1be756beb6a0ff4bebda0478f11f8f4112539db7d6b8ae17a4689a63e404a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
nginx
Etag
"af0d7eb85cafcfd8b3ab546679042bb53d0dcace"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
106
n.js
geo.moatads.com/
102 B
360 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=16&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690785&de=642813573859&m=0&ar=ab397f9-clean&q=3&cb=0&ym=0&cu=1568923690785&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1184374248&cs=0&callback=MoatDataJsonpRequest
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
69139cfa3dc1a14748547b2ec8d6fa7851a50eb9f0613c7a917e604ac64e4229

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
nginx
Etag
"ba5eea03ea1d14545f1333deee0d3beb9c1f1372"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
102
n.js
geo.moatads.com/ Frame 55E2
107 B
365 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690866&de=288868445014&m=0&ar=ab397f9-clean&q=7&cb=0&ym=0&cu=1568923690866&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatW=641&zMoatH=321&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=806374084&cs=0&callback=MoatSuperV26.gna531477
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
4a7a71f03d1f709215fb9f8878d58088d3974fd49f4e07d487af7fd26ae1e5bd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
nginx
Etag
"72ee1be9ce04bd675437e6f91c1820b2513a859b"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
n.js
geo.moatads.com/ Frame C3E3
107 B
365 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=19&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690891&de=621246359667&m=0&ar=ab397f9-clean&q=12&cb=0&ym=0&cu=1568923690891&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=29604729%3A2535697826%3A5050413510%3A138273985938&zMoatPS=top&zMoatPT=article&zMoatW=11&zMoatH=11&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1626964113&cs=0&callback=MoatSuperV26.gna354741
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
ba0925d6aaecf1bd62f6d82148621aef0fddaaec5f1c307932f6274e31714b7a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
nginx
Etag
"47f039262a005e1470e5c6b26db5d640b3caab4e"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9BA0
80 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N410401.281526ZDNET/B22848860.249063861;dc_ver=52.141;sz=970x250;u_sd=1;dc_adk=1069275668;ord=qsmbik;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssRtB6hHtpI9RyH93oGbxye3mm3nUlfHDPhy1rYlgIN4QB2EUQzKMxKnht07XqbreUU7nbeDKA-e0F9-P5SgA1ZJQ5XgWlIQJojfaevJ1xAbHVy458C8CvI1KEUcTviecTT2ozYZxbKLCNapTfx_EfWJ03oQOEEFCQgwhXzLTVD0FBy2khN6OOb0jjMA4TylgZHMUDXqrvicZIokrStTYUCmeDgpX-OpkTTaIcELiFilQZ-udCunNZEPeUj5ViubuRZEkFLfA%26sig%3DCg0ArKJSzO5l31_d5j0VEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F$0;xdt=0;crlt=MZDmMb4)X-;osda=2;sttr=79;prcl=s?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5e9bb6781a479505d4c0fd2c9e468a24d2d9e027f14319f2168aecc7599792cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29469
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 9BA0
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N410401.281526ZDNET/B22848860.249063861;dc_ver=52.141;sz=970x250;u_sd=1;dc_adk=1069275668;ord=qsmbik;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssRtB6hHtpI9RyH93oGbxye3mm3nUlfHDPhy1rYlgIN4QB2EUQzKMxKnht07XqbreUU7nbeDKA-e0F9-P5SgA1ZJQ5XgWlIQJojfaevJ1xAbHVy458C8CvI1KEUcTviecTT2ozYZxbKLCNapTfx_EfWJ03oQOEEFCQgwhXzLTVD0FBy2khN6OOb0jjMA4TylgZHMUDXqrvicZIokrStTYUCmeDgpX-OpkTTaIcELiFilQZ-udCunNZEPeUj5ViubuRZEkFLfA%26sig%3DCg0ArKJSzO5l31_d5j0VEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F$0;xdt=0;crlt=MZDmMb4)X-;osda=2;sttr=79;prcl=s?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 11:58:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 May 2018 20:45:00 GMT
server
sffe
age
29363
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
15207
x-xss-protection
0
expires
Fri, 18 Sep 2020 11:58:47 GMT
970x250_CDM.png
s0.2mdn.net/6357919/ Frame 9BA0
22 KB
22 KB
Image
General
Full URL
https://s0.2mdn.net/6357919/970x250_CDM.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c400e833c536c14553c64e96d837575b14c4bda6bf71984b1b5587d583fd2af3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 13:17:35 GMT
x-content-type-options
nosniff
last-modified
Fri, 17 May 2019 10:08:36 GMT
server
sffe
age
24635
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
22708
x-xss-protection
0
expires
Fri, 20 Sep 2019 13:17:35 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 9BA0
0
356 B
Image
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJb1MZHPQGorRqZ5kEucPv-CivjzTd-VqHAVnKZ0A0H1zGy4AvMTxb5xJuckWhgvPtgXg66KDZNDWwbNf-shpxfjmmy6KZqBqaH-pkZ6zc2PAToGQLDFwuEySeZCMSG4p-Z5t6bSc9Zg&sig=Cg0ArKJSzJBvtwg-YeqXEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:11 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
gpt.js
www.googletagservices.com/tag/js/ Frame 2247
40 KB
13 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?2080902467
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6ca19d70def89831ee636a9a0ff20430686597eacf06f0d6253b5babc5f72e9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"284 / 957 of 1000 / last-modified: 1568909619"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
12708
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:10 GMT
truncated
/ Frame 9BA0
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec8fe5c1ff8114fb8a0a85268fac0f89f75e4119874f8babb447d87412df8da6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
12 KB
5 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=22%3A08%3A10.961&lti=deflated&data=%7B%22id%22%3A245%2C%22ii%22%3A%22%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1568923690958%2C%22cv%22%3A%2220190919-3-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A7715%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A7155.078125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190919-3-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
8c958c4f9b2ed560a4bf139031c3146ccbb20544b4ed93872b86669b6b23be21

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
server
nginx
x-timer
S1568923691.979754,VS0,VE196
status
200
x-served-by
cache-hhn4057-HHN
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 1C83
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/Enqz_20U.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
8395
date
Thu, 19 Sep 2019 12:59:59 GMT
expires
Fri, 18 Sep 2020 12:59:59 GMT
last-modified
Wed, 09 May 2018 20:45:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
25691
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
n.js
geo.moatads.com/ Frame 9BA0
106 B
364 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690971&de=144699760191&m=0&ar=ab397f9-clean&q=17&cb=0&ym=0&cu=1568923690971&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&zMoatPS=top&zMoatPT=article&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=2100550814&cs=0&callback=MoatSuperV26.gna855162
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f2b7990ccef6e21b2c6858fa1763dccd73a2c65dc4d84cf52399d4d35568f8a4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
nginx
Etag
"5f45557ba38271b28e65e2ef1882418779602334"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
106
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690971&de=144699760191&m=0&ar=ab397f9-clean&q=19&cb=0&ym=0&cu=1568923690971&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&zMoatPS=top&zMoatPT=article&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=627804241&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
n.js
geo.moatads.com/ Frame 2247
106 B
364 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=23&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568923690995&de=31074053131&m=0&ar=ab397f9-clean&q=22&cb=0&ym=0&cu=1568923690995&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=870116056&cs=0&callback=MoatSuperV26.gna354976
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.176.167.2 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-176-167-2.eu-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
608367cdddd5973a90f88b8dcfefa558bcdfe803ea6165b5ed89e2a65f7f27ed

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Server
nginx
Etag
"ed3067f271c9ea41d48ddf9456ba8e5c9736893e"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
106
integrator.js
adservice.google.de/adsid/ Frame 2247
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 2247
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019091201.js
securepubads.g.doubleclick.net/gpt/ Frame 2247
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
511c23178d504d371d22fb6899174f448db32523e9cacd2860306a2b3b8cc1f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 12 Sep 2019 13:06:13 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
58953
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:11 GMT
public.json
platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/
3 KB
2 KB
XHR
General
Full URL
https://platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/public.json
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.35.253.113 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-35-253-113.fra6.r.cloudfront.net
Software
nginx/1.14.2 /
Resource Hash
dc586a3b52526c7da4aab5a7d652832306c141deae71784882d150766db361f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Fri, 13 Sep 2019 18:09:22 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
User-Cache-Control
no-cache, must-revalidate
X-Amz-Cf-Pop
FRA6-C1
X-Cache
Hit from cloudfront
Status
200 OK
Connection
keep-alive
Content-Length
1404
X-XSS-Protection
1; mode=block
X-Request-Id
2827141b-8124-421f-abcb-9ef118b7dcc7
X-Runtime
0.030264
Access-Control-Allow-Origin
*
User-Header
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Server
nginx/1.14.2
ETag
W/"dc586a3b52526c7da4aab5a7d6528323"
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET
Content-Type
application/json; charset=utf-8
Via
1.1 b8e900270aa30d899882e71796feca9c.cloudfront.net (CloudFront)
Cache-Control
max-age=900, public
X-Amz-Cf-Id
8LUzwB_lCpAmAb363qeUJ1LknUP5tgirBz4Ezh3VzbsmEqlHlhpDuw==
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=1&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4557104557&L2id=2594531971&L3id=5160351794&L4id=138285768966&S1id=23605329&S2id=23619609&ord=1568923690971&r=144699760191&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=1&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4557104557&L2id=2594531971&L3id=5160351794&L4id=138285768966&S1id=23605329&S2id=23619609&ord=1568923690971&r=144699760191&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fs0.2mdn.net%2F6357919%2F970x250_CDM.png&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&cm=17&f=0&j=&t=1568923690971&de=144699760191&cu=1568923690971&m=20&ar=ab397f9-clean&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7715&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=4&an=0&gf=4&gg=0&ix=4&ic=4&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=4&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=7&cd=0&ah=7&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatPS=top&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d83c87d21d29&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=170499&na=1960974648&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 2247
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4242449739787852&correlator=3546607106792199&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21062420%2C21064549&vrg=2019091201&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190919&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dh%26subses%3D1%26ptype%3Darticle%26vguid%3D623cb559-47fd-413f-b0d7-c357b8460777%7Cenv%3Dprod%26session%3Dh%26subses%3D1%26ptype%3Darticle%26vguid%3D623cb559-47fd-413f-b0d7-c357b8460777&cookie=ID%3D5b1fe033781ad93c%3AT%3D1568923689%3AS%3DALNI_MZts5zVwuBdb7ccuBAw9cB1Ii0-wQ&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1568923691&dt=1568923691151&dlt=1568923690607&idt=531&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=yqb549vdl9ee%7Cphhgzdh3s2bj&ifi=1&ifk=1025331314&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&dssz=17&icsg=43552&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=116664063.1568923690&ga_sid=1568923691&ga_hid=1116491989&fws=384%2C384&ohw=0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
4f244134f326e2cef1edab01bc72536cb610c09bb86602fe12078d02c111edbf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
7074
x-xss-protection
0
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239479696,138239375180
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019091201.js
securepubads.g.doubleclick.net/gpt/ Frame 2247
62 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
7c92ffc225aed56f82019862b155c8d84902352620250d029bbf653a3d7eab61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 12 Sep 2019 13:06:13 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
24116
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:11 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 2247
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

v4
btlr.sharethrough.com/
5 KB
2 KB
XHR
General
Full URL
https://btlr.sharethrough.com/v4?placement_key=8ec3a4f3&campaign_key=DSQasnTB3mo5czP5yHE3kE66H1&mrid=345a76c0-db19-11e9-b82c-153664f085d9
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.77.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-156-77-44.eu-central-1.compute.amazonaws.com
Software
nginx/1.14.1 / Express
Resource Hash
6405a9359708fe9ad2d731d217cba193a12f1c4945d30808ac24b0b1c760c275

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
ETag
W/"1297-0dZjM7h9H8LxqmKXzjllYZ51gNY"
Server
nginx/1.14.1
X-Powered-By
Express
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
2135
butler
b.sharethrough.com/
0
154 B
Image
General
Full URL
https://b.sharethrough.com/butler?type=networkImpressionRequest&pkey=8ec3a4f3&placementIndex=1&networkKey=stxnetwork&networkOrder=1&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%252F&umtime=1568923691179&version=754-4f9e6b06-eu&mrid=345a76c0-db19-11e9-b82c-153664f085d9&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.237.164 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-237-164.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=202&fi=1&apd=205&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4557104557&L2id=2594531971&L3id=5160351794&L4id=138285768966&S1id=23605329&S2id=23619609&ord=1568923690971&r=144699760191&t=hdn&os=1&fi2=0&div1=0&ait=99&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=202&fi=1&apd=205&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4557104557&L2id=2594531971&L3id=5160351794&L4id=138285768966&S1id=23605329&S2id=23619609&ord=1568923690971&r=144699760191&t=nht&os=1&fi2=0&div1=0&ait=99&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:11 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:11 GMT
userx.20190919-3-RELEASE.es6.js
cdn.taboola.com/libtrc/
22 KB
8 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20190919-3-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
40881f2ea8191b832d838358e1577f1dcdcae71ce4277a3d38498e1c8a0e9f05

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
WBy0pL3G5KL1fWb35ls8CffhNABwkde_
content-encoding
gzip
etag
"14b6f33c3f7d321bf1ebc7891256b4e7"
age
26263
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
7735
x-amz-id-2
ujWpolDl5E6LEHZnZydj57Wp1SwuRvE83f+f//vq9XsVKUQLPE+yHQl22lUp5au8AXCQEUKDIpU=
x-served-by
cache-hhn4057-HHN
last-modified
Thu, 19 Sep 2019 12:50:27 GMT
server
AmazonS3
x-timer
S1568923691.222853,VS0,VE0
date
Thu, 19 Sep 2019 20:08:11 GMT
vary
Accept-Encoding
x-amz-request-id
16A270676C7008B7
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
43
x-cache-hits
125740
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
195 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=ce384142cd704960a80c4b26a90cafcf&sd=v2_db80e49d198e821672de99cc8f0c9aff_9391d7aa-458c-4037-b70d-49f8b084a349-tuct47d65aa_1568923690_1568923690_CNawjgYQzro_GM7PjtnULSABKAEwTTin8g1AiI0QSI_JF1C8tTJYAWAA&pi=/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password&wi=-7228989088912292604&pt=text&vi=1568923690958&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=22%3A08%3A11.217&id=8382&llvl=1&cv=20190919-3-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish
server
nginx
x-timer
S1568923691.233514,VS0,VE9
x-served-by
cache-hhn4057-HHN
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
83 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=ce384142cd704960a80c4b26a90cafcf&sd=v2_db80e49d198e821672de99cc8f0c9aff_9391d7aa-458c-4037-b70d-49f8b084a349-tuct47d65aa_1568923690_1568923690_CNawjgYQzro_GM7PjtnULSABKAEwTTin8g1AiI0QSI_JF1C8tTJYAWAA&pi=/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password&wi=-7228989088912292604&pt=text&vi=1568923690958&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A413%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=22%3A08%3A11.217&id=7978&llvl=1&cv=20190919-3-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish
server
nginx
x-timer
S1568923691.233538,VS0,VE9
x-served-by
cache-hhn4057-HHN
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
55 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=ce384142cd704960a80c4b26a90cafcf&sd=v2_db80e49d198e821672de99cc8f0c9aff_9391d7aa-458c-4037-b70d-49f8b084a349-tuct47d65aa_1568923690_1568923690_CNawjgYQzro_GM7PjtnULSABKAEwTTin8g1AiI0QSI_JF1C8tTJYAWAA&pi=/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password&wi=-7228989088912292604&pt=text&vi=1568923690958&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A413%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=22%3A08%3A11.217&id=690&llvl=1&cv=20190919-3-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish
server
nginx
x-timer
S1568923691.272717,VS0,VE16
x-served-by
cache-hhn4057-HHN
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
110 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190919-3-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish
server
nginx
x-timer
S1568923691.275116,VS0,VE9
x-served-by
cache-hhn4057-HHN
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
9 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f4d5a01a2ac800ec210c36d8ccbb07b035378456680a2a11342f75c36af75a47

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
1330734
edge-cache-tag
292832818404376679034978951149021017758,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 05 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
content-length
9070
x-served-by
cache-hhn4075-HHN, cache-hhn4057-HHN
last-modified
Mon, 05 Aug 2019 15:55:09 GMT
server
cloudinary
x-timer
S1568923691.277495,VS0,VE1
etag
"94fea47e9ea24bc1ca790ec6847b847d"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
e5660480cfdcb3569a3e89ceae63cb94b4564e7abf6a5c62dc315b04fdb004c1

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:10 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/
16 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
642ed56ad24006eb248b42f43884568c6444b532fccea4351d5fa182e9cf743d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
844516
edge-cache-tag
299998047715871213859272609536901842855,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 16 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
content-length
15886
x-served-by
cache-hhn4036-HHN, cache-hhn4057-HHN
last-modified
Fri, 16 Aug 2019 16:50:10 GMT
server
cloudinary
x-timer
S1568923691.378452,VS0,VE1
etag
"52410d522d4c73308f048f45ccd44b78"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
5d6f684d97c70.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/
17 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/5d6f684d97c70.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8bfb6d81dbdfe4949d01853d00f4f1835bd9db09fcd1b09c9d5acad9b4844c77

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
896880
edge-cache-tag
418172048420441096747226118010140546740,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 08 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/5d6f684d97c70.jpg
content-length
17912
x-served-by
cache-hhn4058-HHN, cache-hhn4057-HHN
last-modified
Sat, 07 Sep 2019 09:53:21 GMT
server
cloudinary
x-timer
S1568923691.378892,VS0,VE1
etag
"049f4f34394e7714ec8c0faa1b04a7c4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/
17 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
67630a55f8ffa27a91fea510e0c212d1f811adbf85f5a1176226b7959f153cc8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
196773
edge-cache-tag
407464869063555199448578999139967375786,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 18 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
content-length
17353
x-served-by
cache-hhn4069-HHN, cache-hhn4057-HHN
last-modified
Tue, 17 Sep 2019 12:57:27 GMT
server
cloudinary
x-timer
S1568923691.379049,VS0,VE0
etag
"0fc06dcee9eddb92dc6ad5a563917d17"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
0059c40dc4c3e89a7bf1ea76eddc282d.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
20 KB
20 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0059c40dc4c3e89a7bf1ea76eddc282d.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
28ae3ec1631d24e17d01e0e15611a4d53187d71e555251932787df80ff27b642

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
241171
edge-cache-tag
598206649328220703632842837929588111830,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 17 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0059c40dc4c3e89a7bf1ea76eddc282d.jpg
content-length
20369
x-served-by
cache-hhn4022-HHN, cache-hhn4057-HHN
last-modified
Mon, 16 Sep 2019 16:47:42 GMT
server
cloudinary
x-timer
S1568923691.380784,VS0,VE0
etag
"d9dfbd72ded4e19563bfa4cb4f3d1fc7"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
d3cfa62151f9472d853a8f9e1063a09b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
23 KB
23 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d3cfa62151f9472d853a8f9e1063a09b.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a4d80ebf90078608aa493c14d165084dd7259248a12679d3d8aff64e482b2a69

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2781086
edge-cache-tag
500269861978393110103185532168474439143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 22 Aug 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d3cfa62151f9472d853a8f9e1063a09b.jpg
content-length
23042
x-served-by
cache-hhn4041-HHN, cache-hhn4057-HHN
last-modified
Mon, 22 Jul 2019 15:34:07 GMT
server
cloudinary
x-timer
S1568923691.380770,VS0,VE1
etag
"b42694dc77f4c3f8da63f62774c740c4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/
10 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
aa5ed4ff4e8496dd27def7febbed2608fb9bbad340665fb316e2680695873019

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2225449
edge-cache-tag
327211753775464028678123440247850361999,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 05 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
content-length
10065
x-served-by
cache-hhn4020-HHN, cache-hhn4057-HHN
last-modified
Mon, 05 Aug 2019 08:07:04 GMT
server
cloudinary
x-timer
S1568923691.380753,VS0,VE1
etag
"b4239eaebdbe6e6e012b6aea53c1599d"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
05ee445d2c6253de2cdd43c6760d6740.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05ee445d2c6253de2cdd43c6760d6740.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5c3f2fd426e7bc0735be9d2e9e85d23b896bd5d8acbbed79102dd1ab2b8a3675

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2375278
edge-cache-tag
546969359383761264084755791690536953031,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 15 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05ee445d2c6253de2cdd43c6760d6740.jpg
content-length
16608
x-served-by
cache-hhn4024-HHN, cache-hhn4057-HHN
last-modified
Thu, 15 Aug 2019 10:44:40 GMT
server
cloudinary
x-timer
S1568923691.413725,VS0,VE0
etag
"6d8769e564d6f892479a8a375b298a13"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 5
view
securepubads.g.doubleclick.net/pcs/ Frame 1075
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstC63BJdymTyrT1kfN1bWgjzwf8oSRekOb1XGWSXbfLdixvURh35d9JS6Z6cvgrJ2y9Fm0EeehSfNtpNqFthSruPVYMKtiQklzqsplboOH3R3o_kLYmPtUCJM8lgJGg8H90QVmoQ9Ifu6Cx0CkVU-QJuxor8J5lXpDW1JguzAtA9FUTcpAu5dEHuS7Jl4zzX_1Ou6_OsI9yQYgwQRJcREQPNtl7uRe8RvH3U0gfW3HFj1Xyx8TnwC23oTXjl8sxPjCVyR5-LhlS&sig=Cg0ArKJSzNwSL5LWRzA0EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:11 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 1075
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:11 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 1075
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25350
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
view
securepubads.g.doubleclick.net/pcs/ Frame 2B43
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6eAKSH1nHtJIMsPCJhh5qHKQvr7V6i3UX29D1YLzXtifD06eOynofL9Y-u1qpMg-VbpUAlJTh3QrNNYjIYf1Szghqp8WrrDrCtIrw5JMd0_DVnWpd0hyqzZ9NaNSBRIPN6sgtM7dWwkc6wcFHTBKHbLGyF4StSTkTjG3lh2Aw_R2jR6wCYvvk-Q26FYjRYGWuPcLKfr-GABAbpRIEkIjyQRmF9wYpLVtA8sGtQ4-MGR13-NGDCoyPYvwBLA9iDGcLxgPUPPZF&sig=Cg0ArKJSzM4mifB-XDRMEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 19 Sep 2019 20:08:11 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2B43
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29649
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:11 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2B43
307 KB
103 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091201.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Aug 2019 14:24:12 GMT
Server
AmazonS3
x-amz-request-id
994807493D240AA1
ETag
"25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=25350
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104539
x-amz-id-2
K9MLCwXrg8T4XL4nhlhJT/ID+gKDgBoJU7g/okG0NSkM5nYeoB04c40NTTMWyOuK1SBvkY2WUgM=
osd.js
www.googletagservices.com/activeview/js/current/ Frame 2247
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
41ad8ff7e5205f7360535566ad386abb370abb9b92af19005a7ded4a803faf28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568805556061895"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29138
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:11 GMT
5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
9 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f4d5a01a2ac800ec210c36d8ccbb07b035378456680a2a11342f75c36af75a47

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
1330734
edge-cache-tag
292832818404376679034978951149021017758,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 05 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5e0eda0d3b46ee5522f7ba6d0b6f6770.jpg
content-length
9070
x-served-by
cache-hhn4075-HHN, cache-hhn4057-HHN
last-modified
Mon, 05 Aug 2019 15:55:09 GMT
server
cloudinary
x-timer
S1568923691.498247,VS0,VE0
etag
"94fea47e9ea24bc1ca790ec6847b847d"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
731 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190919-3-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
16803
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by
cache-hhn4057-HHN
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1568923692.522211,VS0,VE0
date
Thu, 19 Sep 2019 20:08:11 GMT
x-amz-request-id
29D722C296265892
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
43
x-cache-hits
28545
moatad.js
z.moatads.com/sharethroughv2465247317527/
289 KB
96 KB
Script
General
Full URL
https://z.moatads.com/sharethroughv2465247317527/moatad.js?moatClientLevel1=2ac18247&moatClientLevel2=DSQasnTB3mo5czP5yHE3kE66H1&moatClientLevel3=sfp-DSLY5QiXAsXVXyVmDKFNvksoZz&moatClientLevel4=DSFtXKkiaqXteD5VgQnNspHWdB&moatClientSlicer1=aec2767996d7a4df64f4df7e&moatClientSlicer2=8ec3a4f3&zMoatDSP=sfp&zMoatURLFunc=str-third-party-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1&zMoatIsInView=str-visibility-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1&zMoatTimeInView=str-time-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d46e75cb40cf4322f39ba339cdd826dd6bd90feca0469865457c1dfe420d0c0c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:49:29 GMT
Server
AmazonS3
x-amz-request-id
7CB82369B7509994
ETag
"4a1fdf38246bc42bf0788c4d2a0f7619"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=11628
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
98329
x-amz-id-2
/r9zuMIKWiRNm+eFSpxuim/xwp0DEljrM8kqi9ydfjbDcpx1mKoo7WvKrjjNPwnk+abbMKveDrw=
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
/
www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
64 KB
64 KB
Image
General
Full URL
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 19 Sep 2019 18:49:39 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:11 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
49316402-55a9-44b9-8a37-7e6c96d771b7
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
x-akamai-transformed
9 109975 0 pmb=mTOE,4
expires
Thu, 19 Sep 2019 20:19:39 GMT
native.JPG
str-assets.imgix.net/creative_workflow/creative_thumbnails/427124/images/original/
6 KB
6 KB
Image
General
Full URL
https://str-assets.imgix.net/creative_workflow/creative_thumbnails/427124/images/original/native.JPG?w=170&h=89&auto=format&fit=crop&dpr=1&auto=format
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::720 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
imgix /
Resource Hash
a7c68e6285a6b129d697f9a220220e02e0ecd8969b8aa57e2ddeb057d3841490
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 20:06:45 GMT
server
imgix
age
101
vary
Accept, User-Agent
x-cache
HIT, MISS
content-type
image/webp
status
200
cache-control
public, max-age=600
x-imgix-id
82b830f7c4c3bb0aa566f3a9ad2d2ba8defaf330
accept-ranges
bytes
access-control-allow-origin
*
content-length
6170
x-served-by
cache-lax8628-LAX, cache-hhn4025-HHN
butler
b.sharethrough.com/
0
154 B
Image
General
Full URL
https://b.sharethrough.com/butler?type=impressionReceived&pkey=8ec3a4f3&placementIndex=1&ckey=sfp-DSLY5QiXAsXVXyVmDKFNvksoZz&vkey=DSFtXKkiaqXteD5VgQnNspHWdB&arid=d95450edc-f11f-4b4f-80f4-072fef561772&awid=d15d2ed8-c5f1-4002-a113-8801a043390c&renderOffset=0&bootTime=1599.97&benchmarkBoot=3585.4749996215105&responseTime=373&butlerLatency=373.4400002285838&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%252F&umtime=1568923691553&version=754-4f9e6b06-eu&mrid=345a76c0-db19-11e9-b82c-153664f085d9&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.237.164 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-237-164.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
butler
b.sharethrough.com/
0
154 B
Image
General
Full URL
https://b.sharethrough.com/butler?bwidth=1600&bheight=1200&pwidth=770&pheight=131&pxoff=208&pyoff=1878&pkey=8ec3a4f3&ckey=sfp-DSLY5QiXAsXVXyVmDKFNvksoZz&tkey=bqSbBKSUnnhMPViET2buaJ7u&vkey=DSFtXKkiaqXteD5VgQnNspHWdB&arid=d95450edc-f11f-4b4f-80f4-072fef561772&awid=d15d2ed8-c5f1-4002-a113-8801a043390c&sourceId=sfp&renderInPlace=false&placementIndex=1&twidth=170&theight=89&action=clickout&isVast=false&renderOffset=0&renderLatency=387.9899997264147&type=impression&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%252F&umtime=1568923691566&version=754-4f9e6b06-eu&mrid=345a76c0-db19-11e9-b82c-153664f085d9&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.237.164 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-237-164.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:11 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/
16 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/userx.20190919-3-RELEASE.es6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
642ed56ad24006eb248b42f43884568c6444b532fccea4351d5fa182e9cf743d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
844516
edge-cache-tag
299998047715871213859272609536901842855,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 16 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/static/de/ded12dfc-0935-4ac9-aae4-f2ed2b090440.png
content-length
15886
x-served-by
cache-hhn4036-HHN, cache-hhn4057-HHN
last-modified
Fri, 16 Aug 2019 16:50:10 GMT
server
cloudinary
x-timer
S1568923692.590335,VS0,VE0
etag
"52410d522d4c73308f048f45ccd44b78"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
5d6f684d97c70.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/
17 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/5d6f684d97c70.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8bfb6d81dbdfe4949d01853d00f4f1835bd9db09fcd1b09c9d5acad9b4844c77

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
896880
edge-cache-tag
418172048420441096747226118010140546740,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 08 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//dx6isbzrbkxjw.cloudfront.net/5d6f684d97c70.jpg
content-length
17912
x-served-by
cache-hhn4058-HHN, cache-hhn4057-HHN
last-modified
Sat, 07 Sep 2019 09:53:21 GMT
server
cloudinary
x-timer
S1568923692.597930,VS0,VE0
etag
"049f4f34394e7714ec8c0faa1b04a7c4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/
17 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
67630a55f8ffa27a91fea510e0c212d1f811adbf85f5a1176226b7959f153cc8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
196773
edge-cache-tag
407464869063555199448578999139967375786,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 18 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/adda3cc2-b560-49f8-bb81-0dd97e43ce57/v5_tc_1000x600_188d27cdb93e026be8cb1db2175ca299.png
content-length
17353
x-served-by
cache-hhn4069-HHN, cache-hhn4057-HHN
last-modified
Tue, 17 Sep 2019 12:57:27 GMT
server
cloudinary
x-timer
S1568923692.597950,VS0,VE0
etag
"0fc06dcee9eddb92dc6ad5a563917d17"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
0059c40dc4c3e89a7bf1ea76eddc282d.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
20 KB
20 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0059c40dc4c3e89a7bf1ea76eddc282d.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
28ae3ec1631d24e17d01e0e15611a4d53187d71e555251932787df80ff27b642

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
241171
edge-cache-tag
598206649328220703632842837929588111830,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 17 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0059c40dc4c3e89a7bf1ea76eddc282d.jpg
content-length
20369
x-served-by
cache-hhn4022-HHN, cache-hhn4057-HHN
last-modified
Mon, 16 Sep 2019 16:47:42 GMT
server
cloudinary
x-timer
S1568923692.598005,VS0,VE0
etag
"d9dfbd72ded4e19563bfa4cb4f3d1fc7"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
d3cfa62151f9472d853a8f9e1063a09b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
23 KB
23 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d3cfa62151f9472d853a8f9e1063a09b.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a4d80ebf90078608aa493c14d165084dd7259248a12679d3d8aff64e482b2a69

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2781086
edge-cache-tag
500269861978393110103185532168474439143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 22 Aug 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d3cfa62151f9472d853a8f9e1063a09b.jpg
content-length
23042
x-served-by
cache-hhn4041-HHN, cache-hhn4057-HHN
last-modified
Mon, 22 Jul 2019 15:34:07 GMT
server
cloudinary
x-timer
S1568923692.622930,VS0,VE0
etag
"b42694dc77f4c3f8da63f62774c740c4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/
10 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
aa5ed4ff4e8496dd27def7febbed2608fb9bbad340665fb316e2680695873019

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2225449
edge-cache-tag
327211753775464028678123440247850361999,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 05 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/a54d8613-525c-43e2-bfbe-4a5d2fb48335/iStock-476018262_1000x600_7fa4c910efc99f00b7c27af88088ad28.png
content-length
10065
x-served-by
cache-hhn4020-HHN, cache-hhn4057-HHN
last-modified
Mon, 05 Aug 2019 08:07:04 GMT
server
cloudinary
x-timer
S1568923692.631047,VS0,VE0
etag
"b4239eaebdbe6e6e012b6aea53c1599d"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
05ee445d2c6253de2cdd43c6760d6740.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05ee445d2c6253de2cdd43c6760d6740.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5c3f2fd426e7bc0735be9d2e9e85d23b896bd5d8acbbed79102dd1ab2b8a3675

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:11 GMT
via
1.1 varnish, 1.1 varnish
age
2375278
edge-cache-tag
546969359383761264084755791690536953031,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 15 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05ee445d2c6253de2cdd43c6760d6740.jpg
content-length
16608
x-served-by
cache-hhn4024-HHN, cache-hhn4057-HHN
last-modified
Thu, 15 Aug 2019 10:44:40 GMT
server
cloudinary
x-timer
S1568923692.632391,VS0,VE0
etag
"6d8769e564d6f892479a8a375b298a13"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 6
butler
b.sharethrough.com/
0
154 B
Image
General
Full URL
https://b.sharethrough.com/butler?bwidth=1600&bheight=1200&pwidth=770&pheight=131&pxoff=208&pyoff=1878&pkey=8ec3a4f3&ckey=sfp-DSLY5QiXAsXVXyVmDKFNvksoZz&tkey=bqSbBKSUnnhMPViET2buaJ7u&vkey=DSFtXKkiaqXteD5VgQnNspHWdB&arid=d95450edc-f11f-4b4f-80f4-072fef561772&awid=d15d2ed8-c5f1-4002-a113-8801a043390c&sourceId=sfp&renderInPlace=false&placementIndex=1&twidth=170&theight=89&action=clickout&isVast=false&responseTime=118.82499977946281&type=moatLatency&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%252F&umtime=1568923692096&version=754-4f9e6b06-eu&mrid=345a76c0-db19-11e9-b82c-153664f085d9&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.237.164 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-237-164.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:12 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=22&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29604729&L2id=2535697826&L3id=5050413510&L4id=138273985938&S1id=23605329&S2id=23619609&ord=1568923690891&r=621246359667&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=22&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29604729&L2id=2535697826&L3id=5050413510&L4id=138273985938&S1id=23605329&S2id=23619609&ord=1568923690891&r=621246359667&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&cm=17&f=0&j=&t=1568923690971&de=144699760191&cu=1568923690971&m=1157&ar=ab397f9-clean&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8348&le=1&lf=86&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1148&an=4&gi=1&gf=1148&gg=4&ix=1148&ic=1148&ez=1&ck=1148&kw=817&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1148&bx=4&ci=1148&jz=817&dj=1&aa=1&ad=1045&cn=0&gn=1&gk=1045&gl=0&ik=1045&co=1045&cp=817&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=817&cd=7&ah=817&am=7&rf=0&re=1&ft=1045&fv=0&fw=1045&wb=1&cl=0&at=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatPS=top&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d83c87d21d29&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=170499&na=1644491064&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=817&tet=1148&fi=1&apd=1151&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4557104557&L2id=2594531971&L3id=5160351794&L4id=138285768966&S1id=23605329&S2id=23619609&ord=1568923690971&r=144699760191&t=iv&os=1&fi2=0&div1=1&ait=1045&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&cm=17&f=0&j=&t=1568923690971&de=144699760191&cu=1568923690971&m=1158&ar=ab397f9-clean&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8348&le=1&lf=86&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1148&an=1148&gi=1&gf=1148&gg=1148&ix=1148&ic=1148&ez=1&ck=1148&kw=817&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1148&bx=1148&ci=1148&jz=817&dj=1&aa=1&ad=1045&cn=1045&gn=1&gk=1045&gl=1045&ik=1045&co=1045&cp=817&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=817&cd=817&ah=817&am=817&rf=0&re=1&ft=1045&fv=1045&fw=1045&wb=1&cl=0&at=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatPS=top&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d83c87d21d29&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=170499&na=1315426249&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&cm=17&f=0&j=&t=1568923690971&de=144699760191&cu=1568923690971&m=1159&ar=ab397f9-clean&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8348&le=1&lf=86&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1148&an=1148&gi=1&gf=1148&gg=1148&ix=1148&ic=1148&ez=1&ck=1148&kw=817&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1148&bx=1148&ci=1148&jz=817&dj=1&aa=1&ad=1045&cn=1045&gn=1&gk=1045&gl=1045&ik=1045&co=1045&cp=817&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=817&cd=817&ah=817&am=817&rf=0&re=1&ft=1045&fv=1045&fw=1045&wb=1&cl=0&at=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatPS=top&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d83c87d21d29&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=170499&na=438487591&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 9BA0
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuF-ZAqMwaLKRxGv96G7e1qbMhXjoP04VZYJxEJ_dAD6HXZN7IcwM9ICFo5ycyv4MY234U8AP1imNZeTsPvXYH72SnzBL-uh44r7laqEDM&sig=Cg0ArKJSzGEeJYY7hjA-EAE&adk=1364810931&tt=1524&bs=1585%2C1200&mtos=1097,1097,1097,1097,1097&tos=1097,0,0,0,0&p=393,308,643,1278&mcvt=1097&rs=3&ht=0&tfs=442&tls=1539&mc=1&lte=1&bas=0&bac=0&met=0&la=1&avms=nio&niot_obs=12&niot_cbk=89&md=2&lm=2&rst=1568923690557&rpt=498&isd=0&msd=0&ext=mvo%3D-1%26brt%3D483&oseid=3&xdi=0&ps=1585%2C8348&ss=1600%2C1200&pt=17&bin=1&deb=1-9-9-21-9-18-206-8-0-0-0&tvt=1533&r=v&id=osdim&vs=4&za&uc=7&upc=8&tgt=DIV&cl=1&lop=1&tslp=851&cec=2&clc=1&cac=1&cd=0x0&itpl=19&v=20190918
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:12 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 9BA0
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvzjCjSpl5XSeuc-3ZNknhaKhRAI761RXWqb0XQV4vTQNlkmZEAlw9VR5sErquhkwMXZBOouMURHOkvSpLSQvU&sig=Cg0ArKJSzGWLkXo4Kc9mEAE&adk=1364810931&tt=1524&bs=1585%2C1200&mtos=1097,1097,1097,1097,1097&tos=1097,0,0,0,0&p=393,308,643,1278&mcvt=1097&rs=3&ht=0&tfs=442&tls=1539&mc=1&lte=1&bas=0&bac=0&met=0&la=1&avms=nio&niot_obs=12&niot_cbk=89&md=2&lm=2&rst=1568923690557&rpt=498&isd=0&msd=0&ext=mvo%3D-1%26brt%3D483&oseid=3&xdi=0&ps=1585%2C8348&ss=1600%2C1200&pt=17&bin=1&deb=1-9-9-21-9-18-206-8-0-0-0&tvt=1533&r=v&id=osdim&vs=4&za&uc=7&upc=8&tgt=DIV&cl=1&lop=1&tslp=855&cec=2&clc=1&cac=1&cd=0x0&itpl=19&v=20190918
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Sep 2019 20:08:12 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=201&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29604729&L2id=2535697826&L3id=5050413510&L4id=138273985938&S1id=23605329&S2id=23619609&ord=1568923690891&r=621246359667&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.219.40 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-219-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:12 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:12 GMT
settings.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/917db656-f725-41c5-a080-58eb92128c48/
7 KB
5 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/917db656-f725-41c5-a080-58eb92128c48/settings.js?cb=637044441450568380
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f19ddd7cb20d55597e6eea3817f14ef887cf536841fe4295281d90aa8a08fff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:12 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
7A/9LKR+FJwTZIOKATPq1g==
age
75478
cf-polished
origSize=7150
status
200
last-modified
Wed, 18 Sep 2019 22:55:41 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
e305ba8a-d01e-0060-2a76-6e10e3000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
518e30b68cd9cb98-VIE
expires
Fri, 18 Sep 2020 20:08:12 GMT
lightbox_builder.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame E438
200 KB
27 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637044441450568380
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:12 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
DPY02gsPpNVzBSyytYwMZw==
age
76216
cf-polished
origSize=326600
status
200
last-modified
Wed, 18 Sep 2019 22:55:45 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
de383cc5-001e-00a5-0574-6e6ed8000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
518e30b69cf9cb98-VIE
expires
Fri, 18 Sep 2020 20:08:12 GMT
css
fonts.googleapis.com/ Frame E438
783 B
451 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637044441450568380
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Sep 2019 20:08:12 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 19 Sep 2019 20:08:12 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Thu, 19 Sep 2019 20:08:12 GMT
fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/
1 KB
1 KB
Image
General
Full URL
https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
status
200
etag
W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
date
Thu, 19 Sep 2019 20:08:12 GMT
accept-ranges
bytes
timing-allow-origin
*
content-length
1362
x-served-by
cache-ams21020-AMS, cache-hhn4043-HHN
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame E438
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637044441459236810
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Raleway
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 03 Sep 2019 18:08:35 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:04 GMT
server
sffe
age
1389577
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
13428
x-xss-protection
0
expires
Wed, 02 Sep 2020 18:08:35 GMT
t.gif
www.lightboxcdn.com/z9g/
35 B
129 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1568923693221&h=www.zdnet.com&e=i&u=40913&b=193988&v=empty&s=empty
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 19 Sep 2019 20:08:13 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1170420
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
518e30baabf6cb98-VIE
cf-bgj
imgq:85
utsync.ashx
ml314.com/ Frame 4155
0
361 B
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=5978151499063203811&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&pv=1568923690927_yaic1jge3&bl=en-us&cb=5669513&return=&ht=&d=&dc=&si=1568923686942_xhnngwhy3&cid=&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1982019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.144.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-144-106.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:13 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
application/javascript
Content-Length
0
Expires
0
ud.ashx
in.ml314.com/ Frame 4155
20 B
481 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1982019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1982019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.13.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-175-13-58.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 20:08:13 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Fri, 20 Sep 2019 20:08:14 GMT
pixel.gif
px.moatads.com/
43 B
419 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password%2F&id=1&cm=17&f=0&j=&t=1568923690971&de=144699760191&cu=1568923690971&m=5038&ar=ab397f9-clean&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8348&le=1&lf=86&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5029&an=1148&gi=1&gf=5029&gg=1148&ix=5029&ic=5029&ez=1&ck=1148&kw=817&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5029&bx=1148&ci=1148&jz=817&dj=1&aa=1&ad=4926&cn=1045&gn=1&gk=4926&gl=1045&ik=4926&co=1045&cp=817&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4831&cd=817&ah=4831&am=817&rf=0&re=1&ft=4926&fv=1045&fw=1045&wb=2&cl=0&at=0&d=4557104557%3A2594531971%3A5160351794%3A138285768966&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=970x250&zMoatPS=top&zMoatSZPS=970x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=970&zMoatH=250&zMoatVGUID=623cb559-47fd-413f-b0d7-c357b8460777&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fgootkit-malware-crew-left-their-database-exposed-online-without-a-password&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d83c87d21d29&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=170499&na=650894451&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 19 Sep 2019 20:08:16 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
AkamaiNetStorage
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 19 Sep 2019 20:08:16 GMT
/
www.zdnet.com/homepage/xhr/
258 KB
28 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f8e1a5afff6c74496705402ae5b4b1bd82cc5e3e80bdf1cd0e768b6e8080142f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
27433
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 19 Sep 2019 19:15:21 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:19 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
a53cf413-0636-471b-b1dc-c02e74dc4bf6
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 19 Sep 2019 20:45:21 GMT
ring.gif
zdnet3.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/ring.gif
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88262
status
200
vary
Accept-Encoding
content-length
9039
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-3f75"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:16 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88262
status
200
vary
Accept-Encoding
content-length
1513
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-6fa"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:16 GMT
ZDLogoMicroWhite-x2.png
zdnet1.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/
2 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1568834747-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1806-fly/css/core/main-44cfd58730-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88262
status
200
vary
Accept-Encoding
content-length
1398
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-691"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Sep 2019 19:37:16 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
753 B
533 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
396951
status
200
vary
Accept-Encoding
content-length
426
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7a1c4a-2f1"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 22 Sep 2019 05:52:28 GMT
tr-premium-promo-49ebdaab89-rev.js
zdnet2.cbsistatic.com/fly/js/components/
461 B
394 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
482213
status
200
vary
Accept-Encoding
content-length
287
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:03 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d7a1c4b-1cd"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 21 Sep 2019 06:11:26 GMT
load-more-34f6119ea4-rev.js
zdnet3.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
503411
status
200
vary
Accept-Encoding
content-length
1803
x-xss-protection
1; mode=block
last-modified
Thu, 12 Sep 2019 10:22:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7a1c4a-12a2"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 21 Sep 2019 00:18:07 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
0
0

/
www.zdnet.com/m3d0s1/xhr/horizontal/
0
0

/
www.zdnet.com/components/tr-promo-asset/xhr/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1806-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a291b10722c92316639311121db32329c1f5ce27a040afeca535d2b422bfad38
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
639
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 19 Sep 2019 19:52:52 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 19 Sep 2019 20:08:20 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
9e3549d9-cf7b-4882-a27b-199993fb1585
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 19 Sep 2019 21:22:52 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/
8 KB
3 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1806-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
180061
status
200
vary
Accept-Encoding
content-length
2472
x-xss-protection
1; mode=block
last-modified
Mon, 16 Sep 2019 16:25:00 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d7fb75c-1f51"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 24 Sep 2019 18:07:18 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Sep 2019 20:08:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2467720
status
200
vary
Accept-Encoding
content-length
3552
x-xss-protection
1; mode=block
last-modified
Tue, 20 Aug 2019 17:44:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d5c3187-f53"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 29 Aug 2019 06:39:29 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
zdnet-1.disqus.com
URL
https://zdnet-1.disqus.com/count.js
Domain
www.zdnet.com
URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Domain
www.zdnet.com
URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/

Verdicts & Comments Add Verdict or Comment

329 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| knownServiceWorkers object| _sf_async_config number| _sf_startpt object| _cbq object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define function| $ function| jQuery number| BOOMR_lstart object| _sp_ function| renderAdCallback function| blankAdCallback undefined| testGroup undefined| testName object| jQuery183019310822911197145 object| googletag object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| BOOMR object| BOOMR_mq object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om object| _ml undefined| google_measure_js_timing function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in function| Visitor object| visitor function| DIL number| s_objectID number| s_giq function| lightboxjs function| lightboxlib object| EF function| dw_callback boolean| __v5k function| vl_cB function| vl_disable function| vglnk_15689236868626 undefined| easyXDM object| AudEng object| URS object| DIGIOH_API object| LIGHTBOX_API object| Modernizr function| Waypoint number| _sf_endpt object| debug string| firstpgvar object| CryptoJS object| mPulseApp number| BOOMR_configt object| __ql string| path string| host object| scriptTags object| _bmrEvents undefined| jQuery1710579799984051174_1568923686965 object| TRUE_ANTHEM undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr object| _cb_shared object| pSUPERFLY_mab object| pSUPERFLY undefined| vglnk_15689236873627 object| headertag function| headertag_render object| pbjs object| DW object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit undefined| vglnk_15689236875169 object| s_i_cnetzdnetglobalsite object| jQuery1710579799984051174 string| adBlockCookieValue object| $tealium boolean| google_noFetch number| __google_ad_urls_id number| BOOMR_onload object| ret boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url function| udm_ function| ns_order object| ns_ object| ns_p function| fbq function| _fbq object| UA string| disqus_shortname object| trx object| QSI object| TRC object| _tblConsole object| _taboola object| _comscore undefined| msg string| pm_pgtp number| _rnd string| __prot object| __i number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl object| COMSCORE string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaData undefined| vglnk_156892369044210 object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 boolean| attachedML object| MoatDataJsonpRequest number| taboola_view_id undefined| vglnk_156892369136211 function| str-time-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1 function| str-third-party-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1 function| str-visibility-sfp-DSLY5QiXAsXVXyVmDKFNvksoZz-8ec3a4f3-1 undefined| GLOBAL_VAR undefined| ct undefined| et undefined| hourElapsed undefined| pixelDomain undefined| isDomless undefined| documentReferrer undefined| isBeta undefined| viewHash undefined| pxSrc undefined| px object| callbacks object| Moat#PML#26#1.2 function| Moat#PSCB_1645-1bd7-1e14-1d65_67783100 function| MoatPxIOPT20069013 function| Moat#PSCB_1645-1bd7-1e14-1d65_50927049 function| MoatPxIOPT72593769 function| Moat#PSCB_1645-1bd7-1e14-1d65_44344300 function| MoatPxIOPT96606928 function| Moat#PSCB_1645-1bd7-1e14-1d65_46325228 function| MoatPxIOPT37627138 number| customInviewPercentThreshold object| time

32 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 46454961277536362663058320685457900071
.lightboxcdn.com/ Name: a1583f50-579b-41d0-8c4e-1cd1790d945c
Value: N4Ig-mBGAeDGCuAnRIBcoAOGAuBnNAjAKwBsAHAJwBMAzORQCyUA0IGAbrAHbaGu75UxerXpMKrDrm68hrREgA2aECFaKlKgPQBDRNgCWsRQFMtAcwD2l7AGsD2ALQBbHYoDuek49iIT7x1MAMydsAAsTA0RHABMdbB1IHVxvE2gMSxSYx0suRQMub3cHMMt4Jx1HDGTcd0tEGK01EEU8QlJKUUpxSU1UAG0QXX0jUwtrOwcXN08.Hz8A4NCIqNj4xOTU9MyTbNz8wsdi8LKKqpq6hqaAXQBfVggYDD92NFA4gE9BfuFOukoiFQyHcHlBoCZ2CYeIJgPdwGDYAYYiodLAdCZIP9HAwGDQGNiqLBII4yEEKNkAAwEMhEWBBIJUSAEADs3l-1H-zIpzIoIFuQA
.lightboxcdn.com/ Name: __bxtest
Value: IYIwxgHgngXkA___
.lightboxcdn.com/ Name: __cfduid
Value: d1ea5e2c11e9f1c501ee93d551d882e9a1568923686
.zdnet.com/ Name: RT
Value: "sl=1&ss=1568923685867&tt=3717&obo=0&bcn=%2F%2F684dd306.akstat.io%2F&sh=1568923689588%3D1%3A0%3A3717&dm=zdnet.com&si=7270ade0-87e9-49a6-95b0-c4f3be815a37&ld=1568923689588"
.zdnet.com/ Name: utag_main
Value: v_id:016d4b23977b000e64d6dfe33cf100079006907100b08$_sn:1$_ss:0$_st:1568925489572$ses_id:1568923686781%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: fly_default_edition
Value: uk
www.zdnet.com/ Name: _cb
Value: DRLhUZB4tCirCRI5Rv
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C46250790873254166583037357462225766239%7CMCAAMLH-1569528487%7C6%7CMCAAMB-1569528487%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1568930887s%7CNONE%7CMCAID%7C2EC1F01385158000-400868C6800E8930%7CvVersion%7C2.3.0
.demdex.net/ Name: dextp
Value: 269-1-1568923687546|477-1-1568923687646|771-1-1568923687747|22052-1-1568923687849|30646-1-1568923687949|121998-1-1568923688050|127444-1-1568923688151
www.zdnet.com/ Name: viewGuid
Value: 623cb559-47fd-413f-b0d7-c357b8460777
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/ Name: aam_uuid
Value: 46454961277536362663058320685457900071
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
www.zdnet.com/ Name: _cb_svref
Value: null
www.zdnet.com/ Name: LDCLGFbrowser
Value: 0fad0016-258b-4295-9f5e-3834d9a08f19
.zdnet.com/ Name: first_page_today
Value: false
.zdnet.com/ Name: s_vnum
Value: 1571515687321%26vn%3D1
www.zdnet.com/ Name: _chartbeat2
Value: .1568923687340.1568923687340.1.z2H8pCfr0NKCSBdkkDtiOjvItMTs.1
.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password Name: CBS_INTERNAL
Value: 0
www.zdnet.com/ Name: _cb_ls
Value: 1
.zdnet.com/ Name: s_invisit
Value: true
.zdnet.com/ Name: fly_preferred_edition
Value: uk
www.zdnet.com/ Name: XCLGFbrowser
Value: BdOybV2D4CfcGLXVlEs
.zdnet.com/ Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22h%22%2C%22subSession%22%3A%221%22%7D
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "gb"}
www.zdnet.com/ Name: _ccmaid
Value: 5978151499063203811
.zdnet.com/ Name: s_getNewRepeat
Value: 1568923687322-New
.zdnet.com/ Name: s_cc
Value: true
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: s_lv_zdnet
Value: 1568923687322
www.zdnet.com/ Name: _ccmsi
Value: 1568923686942_xhnngwhy3|1568923686942

57 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 522)
Message:
dom not ready, setting event
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 757)
Message:
ADS: queuing nav-ad-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1216)
Message:
ADS: queuing intromercial-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1284)
Message:
ADS: queuing leader-plus-top-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1397)
Message:
ADS: queuing inpage-video-top-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1407)
Message:
ADS: queuing sharethrough-top-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1650)
Message:
ADS: queuing mpu-plus-top-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1754)
Message:
ADS: queuing dynamic-showcase-top-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1761)
Message:
ADS: queuing mpu-middle-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1962)
Message:
ADS: queuing mpu-bottom-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 1980)
Message:
ADS: queuing leader-plus-bottom-5d83c87d21d29 for display
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 524)
Message:
dom ready, triggering load
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_chartbeat
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log (Line 61)
Message:
blank creative loaded: 138245072116 (5 x 5, pos=nav)
console-api log (Line 61)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log (Line 61)
Message:
blank creative loaded: 138239479696 (372 x 142, pos=)
console-api log (Line 61)
Message:
blank creative loaded: 138239375180 (372 x 142, pos=)
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c812.akstat.io
684dd306.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
b.sharethrough.com
beacon.tru.am
btlr.sharethrough.com
c.evidon.com
c.go-mpulse.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cdn-magiclinks.trackonomics.net
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
dpm.demdex.net
dw.cbsi.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
in.ml314.com
js-sec.indexww.com
l.betrad.com
lightboxapi1.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
platform-cdn.sharethrough.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
str-assets.imgix.net
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
www.zdnet.com
zdnet-1.disqus.com
104.17.208.240
104.96.148.23
13.32.218.158
13.35.253.113
151.101.113.181
151.101.114.133
151.101.114.2
152.199.23.241
172.217.16.198
172.217.21.194
172.217.22.98
185.33.223.216
2.18.233.143
2.18.233.201
2.20.171.216
216.58.210.2
23.0.36.169
23.39.101.26
23.5.109.152
23.58.219.40
23.99.128.52
2600:9000:20bb:3a00:1d:8c8c:47c0:93a1
2600:9000:20bb:5a00:18:1fcd:349:ca21
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4da5
2606:4700::6810:4fa5
2606:4700::6810:a10d
2a00:1288:110:833::4000
2a00:1450:4001:809::200a
2a00:1450:4001:80b::2006
2a00:1450:4001:814::2002
2a00:1450:4001:819::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:81e::2002
2a00:1450:4001:81e::2003
2a00:1450:4001:81f::2002
2a00:1450:4001:81f::2004
2a00:1450:4001:825::2001
2a00:1450:4001:825::2003
2a01:4a0:1338:28::c38a:ff12
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:1b::621
2a04:4e42:1b::720
2a04:4e42:3::444
3.225.50.203
34.231.237.164
34.247.144.106
35.156.77.44
35.175.13.58
35.176.167.2
35.190.38.167
35.190.72.21
35.227.208.151
52.212.161.170
52.28.51.75
52.49.100.189
52.50.119.187
52.72.182.57
54.154.201.99
54.194.238.142
54.93.117.16
63.32.253.244
64.30.230.22
66.117.28.68
66.117.28.86
72.247.224.248
72.247.225.98
72.247.226.64
99.80.15.126
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
0962d49d8a2007c6c4da8a2098c0e2cb52e61298ebdff2fd7ec4546942b0719b
09ffd1768bcceddb2860df0b2004a6e6fb19b335e2cd72e20af3b4c3464b3411
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0d4c63acf1883cc67df48a08701d832f58db2640bc374979793dcde9f41cd6c1
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0
1683b7845dcb3f17015d7f300c9da255ee8b8b739541a8b4c5598a4b95940188
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1926626353ac16192616b413195f159e36ff2c55495f075c39a94f43d0ff9cea
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1dbebf988c786659a862c8243be541462c85ada4815b5f35d7219f759bac36f0
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
24c28b5d6fde57af21dbaf889a64d41aa543cf8b898b4e1fea3e24696051bfcc
28ae3ec1631d24e17d01e0e15611a4d53187d71e555251932787df80ff27b642
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2cf3745c81122542ed6598c484233ce3a5b8eac99426c128cd656fa1ff4b0dc1
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2f19ddd7cb20d55597e6eea3817f14ef887cf536841fe4295281d90aa8a08fff
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
31d62de6466df1262b2b50e20fd9f066063c4254609989bf08eb034c9863ee5f
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
377b570f154d67f670f428f6aea06b9d20e49ae009fec4faa5fc8ec027d38280
381f5020ebfe45da4c04d671ec56fda1bdf6b7fdaec9b46b8369340ba9f27102
396bf68eca1ce17182ad5a282b4eac1039766aabac1d446c8b457d558a8ca249
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3d08b932f216c470bc103f01817b70467347dc80849f57445572fe8b9557caa4
3fd826e43847a2346d37d18e97a553b5966c6e3e22ad3be8ab4a3efd28396478
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
40881f2ea8191b832d838358e1577f1dcdcae71ce4277a3d38498e1c8a0e9f05
41ad8ff7e5205f7360535566ad386abb370abb9b92af19005a7ded4a803faf28
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
44381650043ad53b55fabda73ac870951ac2cd479b9646732b48e396e6661891
4937f9c9905ef23a46422b468695b0f332d492ff592f8712c37639c30a719350
4a7a71f03d1f709215fb9f8878d58088d3974fd49f4e07d487af7fd26ae1e5bd
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4cbbded69e58ffd516843ca83e654d18df040daa36e54f40daf4b756f52e853b
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4f244134f326e2cef1edab01bc72536cb610c09bb86602fe12078d02c111edbf
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
4f9457dd3bd122ecd2b051ccde197acc46c2efb43c47ce4e0bd88ced9f07bf5d
4fc0f920b9a4187756ed4414de20cb15651f7f77bc2e5c56bed4082e6b4d2ebe
50419a81e8b9b8fae61d62102fd680cb2d010a641270d1bf53f3402332f0bdbd
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
511c23178d504d371d22fb6899174f448db32523e9cacd2860306a2b3b8cc1f5
5611e0fcae195ff1fb019d819f1a6e49eeb9ea8a37474eb611777edb07ec1856
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
5c3b61444760e8bfdb8b13c818cfba99992feb0b0ff796f49bef2caffaab30e2
5c3f2fd426e7bc0735be9d2e9e85d23b896bd5d8acbbed79102dd1ab2b8a3675
5e2d4d1e5fea6212e0b4875a4a1c5d2db1e83137d2688a184f322cb0ecf753e9
5e9bb6781a479505d4c0fd2c9e468a24d2d9e027f14319f2168aecc7599792cf
5eb71a23f7c7e04b24468e3bcccfab972621e566b21d4d395b2b801324db8b5b
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5f4147d470235edc4e770d186e5abddbafd1ae66fcecd03eaddc751fcbd782ff
5f889444aff25ca5d87419f5a4abb5531ff5e1824bb4c12b0b4e770686b5551e
608367cdddd5973a90f88b8dcfefa558bcdfe803ea6165b5ed89e2a65f7f27ed
6405a9359708fe9ad2d731d217cba193a12f1c4945d30808ac24b0b1c760c275
642ed56ad24006eb248b42f43884568c6444b532fccea4351d5fa182e9cf743d
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
65e6b5b282d5a23a0f1e6f8860d5b3258a249e3c23dd906b41ef193950dd0799
661582515dd231f99fdd37d11c1237a8e001ab99b898dc1430ac2f73f718098c
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
67630a55f8ffa27a91fea510e0c212d1f811adbf85f5a1176226b7959f153cc8
69139cfa3dc1a14748547b2ec8d6fa7851a50eb9f0613c7a917e604ac64e4229
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6ab3757204be1efa0b178b31717b961e32dc7c4a137c4dcdf9d9acd757797c28
6c67ca4126a3b39a0db2f9546a9009d6344f09e0e34be4c60b7b835357bbcf2a
6ca19d70def89831ee636a9a0ff20430686597eacf06f0d6253b5babc5f72e9f
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392
742e8a8058ca031723c29ca0b042360d95c26c8d4f53621165639b9d83142890
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
79883017f5f729de3512e558228469dfb0f8f5d64f2d117f0102ca898d06e720
79fdfb83309bd0be457dadee31c0a84d0a270a02ead3858163edb06a860c84f5
7c92ffc225aed56f82019862b155c8d84902352620250d029bbf653a3d7eab61
7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b
831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
890da84f91eaaef3193974ab2314bae84ba94da64b702a61bc427a48799baa5d
89437728baeaed41cd20c297085f546e48a421b62ec6457cc722f2128549869f
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8bfb6d81dbdfe4949d01853d00f4f1835bd9db09fcd1b09c9d5acad9b4844c77
8c958c4f9b2ed560a4bf139031c3146ccbb20544b4ed93872b86669b6b23be21
8f7d259350c45463129525e55790ac6af9f9204b28bbd06d1d9158439228bbf2
918ff32e8386f866bb2ce61d337b976ce73d48a68f215d99927d2febaf3c156a
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
96d487a0c7dd457eb22a400e8861a2edc90596164a67684fbe4715713e9fad7d
987e579383d314629d416356d4241c927d4e2ebc86623431e8d810b1296bfb87
98ed0b4b2f8fc0b0014bab1914433944d87a9d9fb7f3e068763a5198aeeb1c94
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
a0118eb45f9fe5d319f81d27b2897b0f488c7c6904a8aa7a18b718505f04efc1
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1e738ee52cc1b803eba38988922c9a8b04fc1d25418ff4b6b7d0ef6d6018f3b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a291b10722c92316639311121db32329c1f5ce27a040afeca535d2b422bfad38
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a2db833a2d180d6b466d9fe89d94b0295ef00f889dc15768a204cc7d9227fb05
a46efac6cae6129da9f72c7d34a7f9c5d8bf39bf927984395e16405affab0302
a4d80ebf90078608aa493c14d165084dd7259248a12679d3d8aff64e482b2a69
a5961bc7be5b4f176cce4b2b8b2b5af1744b19d7348c4aa82a62b036c30602c5
a7c68e6285a6b129d697f9a220220e02e0ecd8969b8aa57e2ddeb057d3841490
aa5ed4ff4e8496dd27def7febbed2608fb9bbad340665fb316e2680695873019
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b49353d5c918e8e37556eea8f23dfb856775024b8389034b0df46bbb52b18fa4
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b5817995fc826ef80ea5b3fa55c849f3b25d6183e155beea335726a7fb3f93da
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
ba0925d6aaecf1bd62f6d82148621aef0fddaaec5f1c307932f6274e31714b7a
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bdb714e5520dfb6840b8e3684b581a81f7a89c24059ec31f28c7e9e3cc5eca76
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
bfb1be756beb6a0ff4bebda0478f11f8f4112539db7d6b8ae17a4689a63e404a
c400e833c536c14553c64e96d837575b14c4bda6bf71984b1b5587d583fd2af3
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c7ca72c9211851a635cbeace8657ce6ca37144c4034d6f9000ff9fb513dbc0ba
c8a470e3401a22d53d3d819af1c0427d46961c74128addcc4cfe546c9ae8d1e0
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cce60b66869b45065bbea45a8225547dd9d13874446fef0a0f56c712ef56ad57
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cd7e202860108c364068ba0dfc50f8f78b12c20cab30723feff677fb6658b292
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d36fe133d112aef3195ad33bfaedabec470f2893364828e0db54610c007bc5ff
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
d46e75cb40cf4322f39ba339cdd826dd6bd90feca0469865457c1dfe420d0c0c
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6a6912a2b7c9f99f608d4a6f223e93b47a1b5a5e961000ccd4e8100ff1be19b
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d8064cf1525cfe6cd379de0ad85a89fa9d4d5bd46ffdae557d90b5935bedc40f
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
daeee543d809373883b98fcdd914fe148875807360408aea3eed5874733f1bdb
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc586a3b52526c7da4aab5a7d652832306c141deae71784882d150766db361f8
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e0799a9473132c6e88f2fb5a84d31c7e3759f3687bba3b6f499671522eb0b50e
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0b13f9ad3def17b72bfda7f42766042b0f6810bee501425ae024bb1e630bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e5660480cfdcb3569a3e89ceae63cb94b4564e7abf6a5c62dc315b04fdb004c1
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb
eabf02dafea4d62b8ddf7e834712aca0cbd9e3207216c63ae56899ee4f66b0c2
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ebbd7cae48601e61f827f5eb6510a679ed56d12c7dc8a305d53821c70273aeff
ec8fe5c1ff8114fb8a0a85268fac0f89f75e4119874f8babb447d87412df8da6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efd40f332a97e62c2e29d6ce9f98dc7b52488333cadd7498df77de6b97b0989f
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f29a0dc63fd89192d786b1a283c9683155574c621afb42e9eff2845ff036a93b
f2b7990ccef6e21b2c6858fa1763dccd73a2c65dc4d84cf52399d4d35568f8a4
f4d5a01a2ac800ec210c36d8ccbb07b035378456680a2a11342f75c36af75a47
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f7d4d75c81551cd3ecbd65c7e01cc7637e34bc1bce0efee4d5cf22c28e87e4da
f8e1a5afff6c74496705402ae5b4b1bd82cc5e3e80bdf1cd0e768b6e8080142f
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89
faf76c260e80e58ae33959e1811a7b6d4ec9626f44c2a2910e6d5055f05a01e0
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5