www.theregister.co.uk Open in urlscan Pro
104.20.250.41 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Submission: On May 01 via api (May 1st 2018, 7:42:32 pm UTC) from US

Summary HTTP 76 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 19 IPs in 3 countries across 17 domains to perform 76 HTTP transactions. The main IP is 104.20.250.41, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.theregister.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 3rd 2017. Valid for: a year.

This is the only time www.theregister.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 26	104.20.250.41 104.20.250.41	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.217.22.42 172.217.22.42	15169 (GOOGLE) (GOOGLE - Google LLC)
1	216.58.214.34 216.58.214.34	15169 (GOOGLE) (GOOGLE - Google LLC)
18	104.20.202.52 104.20.202.52	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	172.217.22.34 172.217.22.34	15169 (GOOGLE) (GOOGLE - Google LLC)
4	216.58.207.34 216.58.207.34	15169 (GOOGLE) (GOOGLE - Google LLC)
2	216.58.214.67 216.58.214.67	15169 (GOOGLE) (GOOGLE - Google LLC)
1	199.96.57.6 199.96.57.6	13414 (TWITTER) (TWITTER - Twitter Inc.)
1	157.240.20.19 157.240.20.19	32934 (FACEBOOK) (FACEBOOK - Facebook)
3	172.217.22.78 172.217.22.78	15169 (GOOGLE) (GOOGLE - Google LLC)
1	52.85.184.140 52.85.184.140	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	172.217.22.65 172.217.22.65	15169 (GOOGLE) (GOOGLE - Google LLC)
1	74.125.133.156 74.125.133.156	15169 (GOOGLE) (GOOGLE - Google LLC)
1	185.60.216.35 185.60.216.35	32934 (FACEBOOK) (FACEBOOK - Facebook)
2 3	185.33.223.208 185.33.223.208	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
3	52.4.183.229 52.4.183.229	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
4	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE - Google LLC)
2 3	34.198.128.122 34.198.128.122	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 2	52.17.182.129 52.17.182.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
76	19

26 104.20.250.41 (San Francisco, United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.theregister.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.theregister.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.42 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.214.34 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s09-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 104.20.202.52 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

nir.regmedia.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
regmedia.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.22.34 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f34.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.207.34 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s24-in-f2.1e100.net

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.214.67 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.96.57.6 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.20.19 (Menlo Park, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: xx-fbcdn-shv-02-frt3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.22.78 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f78.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.184.140 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-184-140.fra2.r.cloudfront.net

s.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.22.65 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f65.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.133.156 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: wo-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.60.216.35 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.223.208 (European Union) 2 redirects

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.4.183.229 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-4-183-229.compute-1.amazonaws.com

a.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.22.38 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f38.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.130 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s18-in-f130.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.198.128.122 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-198-128-122.compute-1.amazonaws.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.182.129 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-17-182-129.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	theregister.co.uk 1 redirects www.theregister.co.uk go.theregister.co.uk	125 KB
18	regmedia.co.uk nir.regmedia.co.uk regmedia.co.uk	94 KB
7	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	81 KB
6	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	74 KB
4	2mdn.net s0.2mdn.net	123 KB
4	dpmsrv.com s.dpmsrv.com a.dpmsrv.com	41 KB
3	rlcdn.com 2 redirects idsync.rlcdn.com	2 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	google-analytics.com www.google-analytics.com	14 KB
2	demdex.net 2 redirects dpm.demdex.net	1 KB
2	gstatic.com fonts.gstatic.com	61 KB
1	facebook.com www.facebook.com	200 B
1	facebook.net connect.facebook.net	62 KB
1	twitter.com platform.twitter.com	36 KB
1	google.nl adservice.google.nl	176 B
1	googletagservices.com www.googletagservices.com	6 KB
1	googleapis.com fonts.googleapis.com	330 B
76	17

	Domain	Requested by
25	www.theregister.co.uk	www.theregister.co.uk
17	regmedia.co.uk	www.theregister.co.uk
5	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.theregister.co.uk
4	s0.2mdn.net	www.theregister.co.uk
3	idsync.rlcdn.com	2 redirects www.theregister.co.uk
3	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
3	a.dpmsrv.com	www.theregister.co.uk s.dpmsrv.com
3	ib.adnxs.com	2 redirects
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net
3	www.google-analytics.com	www.theregister.co.uk
2	dpm.demdex.net	2 redirects
2	fonts.gstatic.com	www.theregister.co.uk
1	go.theregister.co.uk	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	www.facebook.com	www.theregister.co.uk
1	stats.g.doubleclick.net	www.theregister.co.uk
1	s.dpmsrv.com	www.theregister.co.uk
1	connect.facebook.net	www.theregister.co.uk
1	platform.twitter.com	www.theregister.co.uk
1	adservice.google.nl	www.googletagservices.com
1	nir.regmedia.co.uk	www.theregister.co.uk
1	www.googletagservices.com	www.theregister.co.uk
1	fonts.googleapis.com	www.theregister.co.uk
76	23

This site contains links to these domains. Also see Links.

Domain
account.theregister.co.uk
forums.theregister.co.uk
serverlesscomputing.london
www.mcubed.london
continuouslifecycle.london
whitepapers.theregister.co.uk
www.nextplatform.com
twitter.com
www.facebook.com
google.com
www.linkedin.com
search.theregister.co.uk
www.reddit.com
helpx.adobe.com
cve.mitre.org
www.virustotal.com
www.proofpoint.com
pastebin.com
www.youtube.com
portal.msrc.microsoft.com
go.theregister.co.uk
situationpublishing.com

Subject Issuer	Validity	Valid
theregister.co.uk CloudFlare Inc ECC CA-2	`2017-12-03` - `2018-12-03`	a year	crt.sh
ssl828488.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-01-12` - `2018-11-28`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Frame ID: A046B17D7627CFD066F66A265E78762A
Requests: 66 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/creative/60553309/60544172_a9ad36e3bcecd2680e5c6770a58925a8_creative_def.js
Frame ID: 118DDAA50694D6DE490E3BE5CA4893C4
Requests: 6 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/creative/60557381/60544169_eebf22078bd5a20c6472bd4ba873184c_creative_def.js
Frame ID: 77D12978F7B6F800EE32AEFDE4A2FF94
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i
env /^__google_ad_/i
env /^Goog_AdSense_/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^googletag$/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

76
Requests

34 %
HTTPS

0 %
IPv6

17
Domains

23
Subdomains

19
IPs

3
Countries

719 kB
Transfer

1922 kB
Size

10
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://account.theregister.co.uk/login/?&r=https%3A//www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Title: Log in

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/register/?product=theregister_newsletter&r=https%3A//www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://forums.theregister.co.uk/
Title: Forums

Search URL Search Domain Scan URL

URL: https://serverlesscomputing.london/
Title: Serverless

Search URL Search Domain Scan URL

URL: http://www.mcubed.london/
Title: M³

Search URL Search Domain Scan URL

URL: https://continuouslifecycle.london/
Title: CLL

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/events/list
Title: Events

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/
Title: Whitepapers

Search URL Search Domain Scan URL

URL: https://www.nextplatform.com/
Title: The Next Platform

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/user?screen_name=theregister
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/VultureCentral
Title:

Search URL Search Domain Scan URL

URL: https://google.com/+theregister
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/the-register
Title:

Search URL Search Domain Scan URL

URL: https://search.theregister.co.uk/
Title:

Search URL Search Domain Scan URL

URL: https://forums.theregister.co.uk/forum/1/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Title: 32

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/&title=Patch%20or%20ditch%20Adobe%20Flash%3A%20Exploit%20on%20sale%2C%20booby-trapped%20Office%20docs%20spotted%20in%20the%20wild
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Patch%20or%20ditch%20Adobe%20Flash%3A%20Exploit%20on%20sale%2C%20booby-trapped%20Office%20docs%20spotted%20in%20the%20wild&url=https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/&via=theregister
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/&title=Patch%20or%20ditch%20Adobe%20Flash%3A%20Exploit%20on%20sale%2C%20booby-trapped%20Office%20docs%20spotted%20in%20the%20wild&summary=ThreadKit%20leverages%20flaw%20fixed%20in%20February
Title:

Search URL Search Domain Scan URL

URL: https://helpx.adobe.com/security/products/flash-player/apsb18-03.html
Title: a patch

Search URL Search Domain Scan URL

URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4878
Title: CVE-2018-4878

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/bc643750a71236e3033dd91217ba72191106cd66783d6def90f9770820d14a5d/detection
Title: in antivirus engines

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/threat-insight/post/unraveling-ThreadKit-new-document-exploit-builder-distribute-The-Trick-Formbook-Loki-Bot-malware
Title: blog post

Search URL Search Domain Scan URL

URL: https://pastebin.com/bU08esBm
Title: posted to Pastebin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=cjPn1cQy_FE&feature=youtu.be
Title: posted a video

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180004
Title: security update

Search URL Search Domain Scan URL

URL: https://go.theregister.co.uk/tl/1759/shttp://www.mcubed.london/
Title: Minds Mastering Machines - Call for papers now open

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/register/?product=thereg_daily_newsletter
Title: Sign up to our NewsletterGet IT in your inbox daily

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/6281/vmware-horizon-cloud-service-on-azure?td=s-uu
Title: VMware Horizon Cloud Service on Azure This white paper describes the use of the platform to meet key business requirements.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/6383/the-state-of-application-delivery?td=s-uu
Title: The state of application delivery Here’s an inside look at the State of Application Delivery in 2018.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/6469/economics-of-insecurity?td=s-uu
Title: Economics of Insecurity Examining how we know economic inefficiencies exist and why the industry seems unwilling to address them.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/6138/conquer-it-automation?td=s-uu
Title: Conquer IT automation Automation provides a new approach to IT service delivery, operations and management.

Search URL Search Domain Scan URL

URL: https://situationpublishing.com/home/contact-us/
Title: Advertise with us

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/alert/?create=1
Title: Alerts

Search URL Search Domain Scan URL

URL: https://situationpublishing.com/
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D97%26pixelIndex%3D0%26r%3D340640%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.theregister.co.uk%252F2018%252F04%252F09%252Foffice_file_attack_reloaded_in_exploit_builder%252F&_=1525203740686 HTTP 302
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D97%2526pixelIndex%253D0%2526r%253D340640%2526tzOffset%253D0%2526url%253Dhttps%25253A%25252F%25252Fwww.theregister.co.uk%25252F2018%25252F04%25252F09%25252Foffice_file_attack_reloaded_in_exploit_builder%25252F%26_%3D1525203740686 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?id=1976936780374796183&q=xImp&v=1.x&cl=97&pixelIndex=0&r=340640&tzOffset=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&_=1525203740686

Request Chain 70

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687&google_gid=CAESEHk_gG0fjTSOEb8PbDlGksE&google_cver=1

Request Chain 71

https://idsync.rlcdn.com/423396.gif?partner_uid=1976936780374796183 HTTP 302
https://idsync.rlcdn.com/423396.gif?partner_uid=1976936780374796183&redirect=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=477&dpuuid=c4275147095fe4e45d67f391cf66834b945830eef6e31757db230953fc6c9485b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=477&dpuuid=c4275147095fe4e45d67f391cf66834b945830eef6e31757db230953fc6c9485b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BDD_UUID%7D HTTP 302
https://idsync.rlcdn.com/362248.gif?partner_uid=06418089830522097723720935366522501338

Request Chain 72

https://go.theregister.co.uk/k/abt_a HTTP 302
https://regmedia.co.uk/2007/09/13/tp.gif

76 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/ 66 KB
14 KB 107ms
86ms Document
text/html 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 637f5020eff2e5658ceb75c707c1a24ab3b6c3583637b24d9cf2d2ba1577ef9f

Request headers

:path: /2018/04/09/office_file_attack_reloaded_in_exploit_builder/
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:19 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 200
x-reg-bofh: pfy01
cache-control: max-age=0
set-cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739; expires=Wed, 01-May-19 19:42:19 GMT; path=/; domain=.theregister.co.uk; HttpOnly
cf-ray: 4144bb0e789a6361-FRA
cf-railgun: direct (starting new WAN connection)
expires: Tue, 01 May 2018 19:42:19 GMT

GET
S 200 css
fonts.googleapis.com/ 444 B
330 B 19ms
14ms Stylesheet
text/css 172.217.22.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Arimo:400%7CArimo:700

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f10.1e100.net

Software

ESF /

Resource Hash

20279531a48af40077e7136437b5436017bed7a4c241e2f504f10a9ef08db6bd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
H2 200 design.css
www.theregister.co.uk/css_picker/webkit/a5044bb7d71f83dec55870fabfbda258ddb25964/ 110 KB
25 KB 25ms
20ms Stylesheet
text/css 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/css_picker/webkit/a5044bb7d71f83dec55870fabfbda258ddb25964/design.css
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f195b9dec2d7806fdab73e49055244534d9fe1adc26d2294361877915f53a01d

Request headers

:path: /css_picker/webkit/a5044bb7d71f83dec55870fabfbda258ddb25964/design.css
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-ray: 4144bb0f3a236361-FRA
status: 200
content-length: 24993
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 17 Apr 2018 12:30:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy04
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 _.js Show response
www.theregister.co.uk/design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/ 213 KB
63 KB 37ms
33ms Script
application/javascript 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/_.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0c70d52bb9a0b334013b32f8202fb2e6335582dbcd7fff6ddbe049a3afcbf8b

Request headers

:path: /design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/_.js
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 05 Apr 2018 13:53:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a246361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ 13 KB
6 KB 47ms
42ms Script
text/javascript 216.58.214.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

216.58.214.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s09-in-f2.1e100.net

Software

sffe /

Resource Hash

5b62faa59793bb8e2cab4da73edd1d8b25fb2a2777d923c474c2ddea678932a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "4 / 591 of 1000 / last-modified: 1525199428"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 5696
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
S 200 / Show response
nir.regmedia.co.uk/ 39 B
409 B 96ms
53ms Script
application/x-javascript 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://nir.regmedia.co.uk/?g=c&g=sa&s=c/sec.front
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af698b9f65af1aa14b8c0d4101c7898e0396cedff30273f4a56c14c5f38358e

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 19:42:20 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
content-type: application/x-javascript
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: policyref="http://www.theregister.co.uk/Design/page/p3p/nir.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa OUR IND UNI COM NAV INT"
status: 200
x-reg-bofh: PFY03
cache-control: no-cache
cf-ray: 4144bb0f6d2c9712-FRA
content-length: 39
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 reg_logo.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 28 KB
10 KB 44ms
39ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/reg_logo.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96a01e89ced651607eb0f83151b1f6bee71cbd7fa9a706169c8a1f56f053b32b

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/reg_logo.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a256361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 twitter.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 760 B
520 B 28ms
23ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/twitter.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 384c00e8adcefac1d3c99c0262aa4d493e2b10c145a5d27390d1057bf96c8b0e

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/twitter.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a266361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 facebook.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 316 B
295 B 36ms
32ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/facebook.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0035aca44e38761959d1c2ed3e1595c674ba23fc1a4b193ac7d20186fc6c9d1a

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/facebook.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a276361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 google_plus.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 846 B
537 B 28ms
24ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/google_plus.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b5da230ff3a1736c5b3c48a505bf91f355e1b8e13c1212ef60200792898d44a

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/google_plus.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a286361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 linkedin.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 477 B
468 B 20ms
16ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad743ae9b24b4f8de4039cc4449322a0651996d4f3eeb706fbc63fd4bc4d1822

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Mon, 13 Jul 2015 12:25:44 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a296361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 vulture.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 2 KB
879 B 30ms
26ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/vulture.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 462bb86498f9167acfa5549972ca109dc228ec8149fda26f1ac74389ce8652c8

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/vulture.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a2a6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 vulture_white.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 2 KB
1 KB 44ms
40ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/vulture_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbccc31c6c7a8211b4c79d9c46bb523743319de6bbb32a2002c9fd3db3b003de

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/vulture_white.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a2b6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 search.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 614 B
420 B 45ms
41ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0f8ee28575891a454e30946b1e00e91b0d8ebb0c0d016f9d58ca9d9e1793468

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a2c6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 search_white.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 580 B
408 B 45ms
41ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71451fe2d7b12a9b37b95ceb64843a3df8236b4cebe4d95ce99842334403b2df

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search_white.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a2d6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 dl.gif
regmedia.co.uk/2016/04/14/ 35 B
511 B 11ms
9ms Image
image/gif 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2016/04/14/dl.gif
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: origSize=43
status: 200
content-length: 35
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 14 Apr 2016 13:41:38 GMT
server: cloudflare
etag: "2b-530720dc4f2ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-reg-bofh: PFY01
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb0f7d379712-FRA
cf-bgj: imgq:85

GET
H2 200 burger_menu.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 189 B
222 B 30ms
27ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/burger_menu.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9f1e0973cfcd3c9f396b9ccb8030e9416176c9a21c200552758369713e633a5

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/burger_menu.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 21 Sep 2017 15:42:45 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a2f6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 rect_comment_bubble_white.svg
www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/ 496 B
389 B 27ms
24ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093

Request headers

:path: /design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_white.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Tue, 19 Dec 2017 16:33:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a306361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 reddit.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 2 KB
1 KB 22ms
18ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/reddit.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c806f79b6c2fcb659e5fe273bd96c2e4296833546d5619cebd12372da72dc6e

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/reddit.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 08 Oct 2015 12:52:11 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a316361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 linkedin_alt.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 388 B
333 B 22ms
19ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin_alt.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8afc52a8606259c4b1c70c6132aba5585d4b7ffcd6883be58396497c0ea58f7

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin_alt.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Wed, 12 Aug 2015 15:01:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a326361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 virus_1_648.jpg
regmedia.co.uk/2015/08/07/ 13 KB
13 KB 11ms
10ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/08/07/virus_1_648.jpg?x=442&y=293&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bae12f858343f5babe0326e1fbb4c8b3038bd8a621066bbc3b34e8aebb7a574f

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=47808
status: 200
content-disposition: inline; filename="virus_1_648.webp"
content-length: 13488
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Mon, 17 Jul 2017 14:13:36 GMT
server: cloudflare
etag: "bac0-5548401328a86"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY02
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb0f8d4a9712-FRA
cf-bgj: imgq:85

GET
S 200 flash_7656756345.jpg
regmedia.co.uk/2015/08/12/ 5 KB
5 KB 66ms
66ms Image
image/jpeg 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/08/12/flash_7656756345.jpg?x=174&y=115&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e51745535bd5cb73477fed97637024c52ae004702a08f6cf4b8ed6b63f0eda0

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: degrade=85, origSize=8912
status: 200
content-length: 4816
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Mon, 09 Apr 2018 19:32:59 GMT
server: cloudflare
etag: "22d0-5696f793ad8ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb0fad729712-FRA
cf-bgj: imgq:85

GET
S 200 random_numbers_shutterstock.jpg
regmedia.co.uk/2017/10/22/ 3 KB
3 KB 337ms
337ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2017/10/22/random_numbers_shutterstock.jpg?x=88&y=58&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0321c9599f54c12c28c60a11fa8feb36a0fc9a8613c835e2ec1362a778ba3814

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=3032
status: 200
content-disposition: inline; filename="random_numbers_shutterstock.webp"
content-length: 2930
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Mon, 23 Oct 2017 06:12:24 GMT
server: cloudflare
etag: "bd8-55c30b4c3253e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb100de89712-FRA
cf-bgj: imgq:85

GET
S 200 windows_10.jpg
regmedia.co.uk/2016/02/10/ 2 KB
3 KB 12ms
11ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2016/02/10/windows_10.jpg?x=88&y=58&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce0367c7f081af862e738a8334086da28bc3d1fbc68f2d58b0208832bd4ecee8

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=2569
status: 200
content-disposition: inline; filename="windows_10.webp"
content-length: 2408
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 11 Feb 2016 12:12:35 GMT
server: cloudflare
etag: "a09-52b7d7745885b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY01
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103e149712-FRA
cf-bgj: imgq:85

GET
S 200 six_parked_concordes_photo_british_airways.jpg
regmedia.co.uk/2018/04/27/ 10 KB
11 KB 15ms
15ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/04/27/six_parked_concordes_photo_british_airways.jpg?x=88&y=58&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58b7276b02814e0ee498a4a64e4d5e9374721c95732574b5ca4c053697a267dd

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=12113
status: 200
content-disposition: inline; filename="six_parked_concordes_photo_british_airways.webp"
content-length: 10546
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 01 May 2018 13:12:21 GMT
server: cloudflare
etag: "2f51-56b24b87bf16f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY02
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103e159712-FRA
cf-bgj: imgq:85

GET
S 200 the_pentagon.jpg
regmedia.co.uk/2018/03/07/ 2 KB
2 KB 11ms
11ms Image
image/jpeg 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/03/07/the_pentagon.jpg?x=88&y=58&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21170e3c0ccbaba33f2407165ff70dbfbea958375fe44b2f2f31e16df30dc512

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: degrade=85, origSize=2497, err=webp_bigger
status: 200
content-length: 2213
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Mon, 30 Apr 2018 10:12:21 GMT
server: cloudflare
etag: "9c1-56b0e16e4e987"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103e169712-FRA
cf-bgj: imgq:85

GET
S 200 nasa_galileo.jpg
regmedia.co.uk/2018/04/30/ 2 KB
2 KB 39ms
38ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/04/30/nasa_galileo.jpg?x=88&y=58&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90f9d255b1f05bc80e84f82f7e2788d60b119de3ef73962bfdaf22a176e6326b

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=1940
status: 200
content-disposition: inline; filename="nasa_galileo.webp"
content-length: 1674
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 01 May 2018 18:12:21 GMT
server: cloudflare
etag: "794-56b28e954a827"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY04
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103e179712-FRA
cf-bgj: imgq:85

GET
S 200 jurassic_world_error_message.jpg
regmedia.co.uk/2015/07/23/ 8 KB
8 KB 14ms
14ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/07/23/jurassic_world_error_message.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90082aee0198e73e60371409463221b1cf611bc1bcf2e53061101d3210293b29

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=15432
status: 200
content-disposition: inline; filename="jurassic_world_error_message.webp"
content-length: 8470
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Sun, 14 Feb 2016 07:45:45 GMT
server: cloudflare
etag: "3c48-52bb61689fdb1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY04
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103e189712-FRA
cf-bgj: imgq:85

GET
S 200 spam_cans.jpg
regmedia.co.uk/2015/07/09/ 8 KB
9 KB 11ms
10ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/07/09/spam_cans.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a74143506db8f054666fc64b68a14c29eae0a3f0bf07999e557b4e1377e0d14b

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=20086
status: 200
content-disposition: inline; filename="spam_cans.webp"
content-length: 8668
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 03 Jan 2018 09:46:37 GMT
server: cloudflare
etag: "4e76-561dc177188c1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY02
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb104e309712-FRA
cf-bgj: imgq:85

GET
S 200 shutterstock_emptywallet.jpg
regmedia.co.uk/2018/02/14/ 6 KB
6 KB 15ms
14ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/02/14/shutterstock_emptywallet.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01ff76fb1f8b8a129013e8e720de39fa80a1b0f86206543a3f320dcd2508b206

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=6476
status: 200
content-disposition: inline; filename="shutterstock_emptywallet.webp"
content-length: 6368
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 14 Feb 2018 01:11:43 GMT
server: cloudflare
etag: "194c-56521cb572b07"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb104e329712-FRA
cf-bgj: imgq:85

GET
S 200 microsoft_office_shutterstock_editorial_only.jpg
regmedia.co.uk/2018/02/02/ 4 KB
4 KB 12ms
10ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/02/02/microsoft_office_shutterstock_editorial_only.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 304d91442457853506ff02213f922b9b69af88285fc329d01559db48ee8868d1

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=9744
status: 200
content-disposition: inline; filename="microsoft_office_shutterstock_editorial_only.webp"
content-length: 4400
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Fri, 02 Feb 2018 01:31:14 GMT
server: cloudflare
etag: "2610-56430ab093945"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY01
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb104e3a9712-FRA
cf-bgj: imgq:85

GET
S 200 harry_potter_wand.jpg
regmedia.co.uk/2015/06/25/ 5 KB
5 KB 13ms
12ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/06/25/harry_potter_wand.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba953e4946d5d141443d1128f8d12dd63ce9cb1ce765e2290cf1a3cb40b06021

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=8321
status: 200
content-disposition: inline; filename="harry_potter_wand.webp"
content-length: 5376
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 10 Jan 2018 19:55:06 GMT
server: cloudflare
etag: "2081-56271686caa1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb104e3b9712-FRA
cf-bgj: imgq:85

GET
S 200 office_365_photo_by_dennizn_via_shutterstock.jpg
regmedia.co.uk/2016/09/07/ 8 KB
9 KB 13ms
13ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2016/09/07/office_365_photo_by_dennizn_via_shutterstock.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11d4ad8af79a64a15b9e5e41ef02c6aba75a007fa7658782b1493925785a35db

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=18061
status: 200
content-disposition: inline; filename="office_365_photo_by_dennizn_via_shutterstock.webp"
content-length: 8562
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 03 Aug 2017 01:22:32 GMT
server: cloudflare
etag: "468d-555cf36f4f3b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY01
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb105e4e9712-FRA
cf-bgj: imgq:85

GET
S 200 shutterstock_biz_rage.jpg
regmedia.co.uk/2017/08/17/ 5 KB
5 KB 13ms
11ms Image
image/webp 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2017/08/17/shutterstock_biz_rage.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f22c45cc7909516424404b7df16aad7ff0eec7007a7c31cf9f4c85cc1f70c9e5

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=13715
status: 200
content-disposition: inline; filename="shutterstock_biz_rage.webp"
content-length: 4806
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 17 Aug 2017 10:43:58 GMT
server: cloudflare
etag: "3593-556f0b09bb268"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
x-reg-bofh: PFY02
expires: Sun, 26 May 2019 19:42:20 GMT
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb105e539712-FRA
cf-bgj: imgq:85

GET
S 200 shutterstock_closed.jpg
regmedia.co.uk/2017/10/19/ 8 KB
8 KB 14ms
13ms Image
image/jpeg 104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2017/10/19/shutterstock_closed.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: SPDY
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2091888791c1939d27459b530ba9c819de971227d1b51b2524c66b4ff148f6b0

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
cf-cache-status: HIT
cf-ray: 4144bb106e549712-FRA
status: 200
content-length: 7773
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 19 Oct 2017 11:16:28 GMT
server: cloudflare
etag: "1e5d-55be47ccd7a5f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: PFY03
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 whitepaper_book.png
www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/ 1 KB
1 KB 27ms
24ms Image
image/png 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c

Request headers

:path: /design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 17 Feb 2017 15:08:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb0f3a336361-FRA
content-length: 1119
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 footer_mob_nav_arrow_black.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 688 B
541 B 20ms
17ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/footer_mob_nav_arrow_black.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1d79c5062d02c1f374aa186a22ccd3a3989bc8e281e3ed68349de57a504d426

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/footer_mob_nav_arrow_black.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 16 Mar 2017 14:46:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a346361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 sitpub_footer.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 11 KB
4 KB 34ms
31ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/sitpub_footer.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bcc748644049dde1e44f688701a961692e43867f689c0d407affbf5f2306523

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/sitpub_footer.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 16 Mar 2017 14:46:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a356361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 footer_mob_nav_arrow_white.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 688 B
509 B 44ms
41ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/footer_mob_nav_arrow_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0807a505cb50c2ed34208a45f5ff7e12f8835d6580780636ebe22fcf91fb830

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/footer_mob_nav_arrow_white.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 16 Mar 2017 14:46:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a366361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 linkedin_white.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 752 B
549 B 44ms
42ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0ee2c86f2159021e4f1ab0e3fba452e8d8ed42aeab6cd4a0e6a366e5024ad17

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/linkedin_white.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 16 Mar 2017 14:46:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a386361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 rss.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/ 405 B
364 B 20ms
18ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/rss.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5fd3bf9fd1976777088488c7287b1c67ab24f08e0d5f21e130847e6075379c

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icon/rss.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sun, 14 Jun 2015 17:13:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb0f3a396361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 pubads_impl_199.js Show response
securepubads.g.doubleclick.net/gpt/ 162 KB
57 KB 45ms
45ms Script
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f34.1e100.net

Software

sffe /

Resource Hash

1a427c31646c4dbcda43c5760eb5a224f5e695209d2bb6b1fb40229d6e5e1063

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Apr 2018 00:30:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 58006
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
S 200 integrator.sync.js Show response
adservice.google.nl/adsid/ 115 B
176 B 14ms
13ms Script
application/javascript 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.sync.js?domain=www.theregister.co.uk

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f2.1e100.net

Software

cafe /

Resource Hash

be04ee6479e67725d2dcd744cdacd0cc551e96d3a5318d0e6339fce3b0547839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 109
x-xss-protection: 1; mode=block

GET
H2 200 ads.js Show response
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 27 B
112 B 16ms
15ms XHR
application/javascript 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/_.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739; sc=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control: no-cache
:authority: www.theregister.co.uk
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:method: GET
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 05 Apr 2018 12:48:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 4144bb103c3a6361-FRA
content-length: 27
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 P5sMzZCDf9_T_10ZxCQ.ttf
fonts.gstatic.com/s/arimo/v11/ 49 KB
31 KB 9ms
9ms Font
font/ttf 216.58.214.67
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/arimo/v11/P5sMzZCDf9_T_10ZxCQ.ttf

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

216.58.214.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f3.1e100.net

Software

sffe /

Resource Hash

c53cd1749183aa230d84582dcf3f6b78d313fefbeceec5d21da2f87d078d8046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Arimo:400%7CArimo:700
Origin: https://www.theregister.co.uk

Response headers

date: Mon, 12 Feb 2018 15:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6756091
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 31197
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Oct 2017 18:26:42 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Feb 2019 15:00:49 GMT

GET
S 200 P5sBzZCDf9_T_1Wi4TRDrZc.ttf
fonts.gstatic.com/s/arimo/v11/ 47 KB
30 KB 9ms
9ms Font
font/ttf 216.58.214.67
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/arimo/v11/P5sBzZCDf9_T_1Wi4TRDrZc.ttf

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

216.58.214.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f3.1e100.net

Software

sffe /

Resource Hash

91e12566e30fcdd49adb5cb01baba9e9ce06d813e79a2f6494771e97a8ec5c44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Arimo:400%7CArimo:700
Origin: https://www.theregister.co.uk

Response headers

date: Thu, 08 Feb 2018 19:36:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7085159
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 30480
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Oct 2017 18:31:21 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Feb 2019 19:36:21 GMT

GET
S 200 widgets.js Show response
platform.twitter.com/ 123 KB
36 KB 7ms
7ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/_.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: 7e1549d8014a30c3c17fdca43be710f1c4acbe33706b008f7ef45b99f6b2bbe5

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
age: 1788
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 36295
x-served-by: cache-tw-fra1-cr1-20-TWFRA1
last-modified: Thu, 26 Apr 2018 22:37:34 GMT
x-timer: S1525203740.212668,VS0,VE0
etag: "734cb84ab666fc8eeea3489e24aa3b7d+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=1800
accept-ranges: bytes

GET
H2 200 promo_unit_arrow.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 248 B
276 B 16ms
15ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/promo_unit_arrow.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed

Request headers

:path: /design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/promo_unit_arrow.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739; sc=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/css_picker/webkit/a5044bb7d71f83dec55870fabfbda258ddb25964/design.css
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/css_picker/webkit/a5044bb7d71f83dec55870fabfbda258ddb25964/design.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 24 Aug 2017 14:00:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 4144bb106cb86361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
H2 200 envelope.svg
www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/ 455 B
382 B 23ms
23ms Image
image/svg+xml 104.20.250.41
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.250.41 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ee897eecd34e335a2ff9fadd6d506529e2fedccba062c9a8836777c5538f274

Request headers

:path: /design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
pragma: no-cache
cookie: __cfduid=d264a3646419c3bfeb599ad025f9b91ee1525203739; sc=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.theregister.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Mon, 17 Jul 2017 11:03:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 4144bb109d1a6361-FRA
expires: Sun, 26 May 2019 19:42:20 GMT

GET
S 200 all.js Show response
connect.facebook.net/en_GB/ 205 KB
62 KB 7ms
6ms Script
application/x-javascript 157.240.20.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/609d1e5cd415a6c6e2d2c25fd7b1748651737e8e/javascript/_.js

Protocol

SPDY

Server

157.240.20.19 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-frt3.fbcdn.net

Software

Resource Hash

1c92a97edc483b14c28b1d2c2d0362358609079d1c15163883be5ee5d5a011ca

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
content-encoding: gzip
x-content-type-options: nosniff
content-md5: vn9c/4QoaoDb1LGv51W0Ng==
status: 200
content-length: 63158
x-xss-protection: 0
x-fb-debug: vplVEHNIV6J36yiFMyIBD+S/w1MVNUxZXeRcwQxY04hB4ncR4q3jP0VPscIlK/qhbbRLCHHfZ9HzxWWJLh1luw==
x-fb-content-md5: f1b07038c9802df02f9b668986620ee5
x-frame-options: DENY
date: Tue, 01 May 2018 19:42:20 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "159a136373727b4ecb976fcf7a894899"
timing-allow-origin: *
expires: Tue, 01 May 2018 19:45:23 GMT

GET
S 200 analytics.js Show response
www.google-analytics.com/ 34 KB
14 KB 7ms
6ms Script
text/javascript 172.217.22.78
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f78.1e100.net

Software

Golfe2 /

Resource Hash

2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Apr 2018 18:13:11 GMT
server: Golfe2
age: 2774
date: Tue, 01 May 2018 18:56:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 14353
expires: Tue, 01 May 2018 20:56:06 GMT

GET
H/1.1 200
OK dpm_812ed4562d3211363a7b813aa9cd2cf042b63bb2.min.js Show response
s.dpmsrv.com/ 116 KB
38 KB 360ms
22ms Script
application/x-javascript 52.85.184.140
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.dpmsrv.com/dpm_812ed4562d3211363a7b813aa9cd2cf042b63bb2.min.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: HTTP/1.1
Server: 52.85.184.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-184-140.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d5abcf141f8f0f561f6bc7f92a156adb6a4e5725173bbd41778d12a591d90abf

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 22 Sep 2017 08:32:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Aug 2017 11:00:13 GMT
Server: AmazonS3
Age: 52836
ETag: "2f3636280a7e02208f6c15cc8512f90a"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 249b0d921fdb938596674ad935677340.cloudfront.net (CloudFront)
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38749
X-Amz-Cf-Id: fojs2lZQjXXEUDXQUvRCQsUumeHiSM8DVoMD1GVImKn0APhsplvh0g==

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 37 KB
7 KB 595ms
595ms XHR
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=2436469641258868&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21061804%2C21061149%2C21061771&vrg=199&sc=1&sfv=1-0-23&iu_parts=6978%2Creg_security%2Cfront&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C970x91%7C970x90%7C970x250%7C728x90%7C728x91%7C468x60%7C468x61%2C300x1050%7C300x600%7C300x250%7C300x252%2C300x250%7C300x251%7C300x100%7C300x50%2C300x250%7C300x1%7C300x50%2C970x90%7C728x90%7C468x60&ists=32&prev_scp=pos%3Dtop%26raptor%3Dkite%26unitnum%3D1%7Cpos%3Dtop%26raptor%3Dcondor%26unitnum%3D2%7Cpos%3Dtop%26raptor%3Deagle%26unitnum%3D3%7Cpos%3Dmid%26raptor%3Dfalcon%26unitnum%3D4%7Cpos%3Dbtm%26raptor%3Dowl%26unitnum%3D5%7Cpos%3Dbtm%26raptor%3Dhawk%26unitnum%3D6&cust_params=test%3D0%26protocol%3Dhttps%253A%26li%3Dnull%26uid%3Dnull%26sc%3D1%26bwidth%3D16%26pid%3D195679%26pt%3Da%26axc%3Dmicrosoft%26kw%3Dmicrosoft%2520office%252Csecurity%252Cadobe%2520flash%26cat%3Dnews%26tag%3Dnull%26author%3DThomas%252520Claburn%26year%3D2018%26nsfw%3Dnull%26vid%3Dnull%26ar%3Dfalse%26ct%3Ds-async%26vc%3Dsec.front%26excl_cat%3Dmicrosoft&cookie_enabled=1&bc=5&abxe=1&lmt=1525203740&dt=1525203740349&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C308%2C978%2C978%2C861%2C308&adys=0%2C150%2C255%2C1882%2C3251%2C2259&adks=1331772189%2C3919518880%2C2610646818%2C1573474164%2C3059020159%2C2555511442&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&dssz=25&icsg=3712&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x3864%7C1000x3864%7C315x1897%7C315x1897%7C924x1159%7C1000x119&ga_vid=675195297.1525203740&ga_sid=1525203740&ga_hid=1796495433

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f34.1e100.net

Software

cafe /

Resource Hash

b7f5b5b43216fd88234498aca8d5ebc5caee078096112251a7a4303411f5850d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Origin: https://www.theregister.co.uk

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 7285
x-xss-protection: 1; mode=block
google-lineitem-id: 4529119622,4529119622,4529119622,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138225210829,138225129354,138225128715,-2,-2,-2
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.theregister.co.uk
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_199.js Show response
securepubads.g.doubleclick.net/gpt/ 43 KB
16 KB 40ms
40ms Script
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_199.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f34.1e100.net

Software

sffe /

Resource Hash

3d26b8433950bf918452f3913de7e092c5ce0d586d3f0903aad5e4e33dbdab0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Apr 2018 00:30:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 16506
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-23/html/ 0
0 6ms
6ms Other
text/html 172.217.22.65
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-23/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

172.217.22.65 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f65.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Purpose: prefetch
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 10 Apr 2018 21:45:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1806993
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1479
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Apr 2018 14:51:09 GMT
server: sffe
vary: Accept-Encoding
content-type: text/html
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Apr 2019 21:45:47 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
100 B 7ms
7ms Image
image/gif 172.217.22.78
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j67&a=1796495433&t=pageview&_s=1&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&ul=en-us&de=UTF-8&dt=Patch%20or%20ditch%20Adobe%20Flash%3A%20Exploit%20on%20sale%2C%20booby-trapped%20Office%20docs%20spotted%20in%20the%20wild%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YChAiAABB~&jid=842608977&gjid=1530556912&cid=675195297.1525203740&tid=UA-33330076-1&_gid=1879928068.1525203740&cd2=Thomas%20Claburn&cd3=reg_security%2Ffront&cd4=a&cd5=news&z=1284475451

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f78.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Apr 2018 17:54:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1302480
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
stats.g.doubleclick.net/r/ 35 B
105 B 15ms
14ms Image
image/gif 74.125.133.156
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j67&tid=UA-33330076-1&cid=675195297.1525203740&jid=842608977&gjid=1530556912&_gid=1879928068.1525203740&_u=YChAiAABB~&z=554210612

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

74.125.133.156 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wo-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 01 May 2018 19:42:20 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
94 B 7ms
7ms Image
image/gif 172.217.22.78
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j67&a=1796495433&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&ul=en-us&de=UTF-8&dt=Patch%20or%20ditch%20Adobe%20Flash%3A%20Exploit%20on%20sale%2C%20booby-trapped%20Office%20docs%20spotted%20in%20the%20wild%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=joined_bucket&ea=Joined&el=849&_u=YChAiAABB~&jid=&gjid=&cid=675195297.1525203740&tid=UA-33330076-1&_gid=1879928068.1525203740&cd2=Thomas%20Claburn&cd3=reg_security%2Ffront&cd4=a&cd5=news&z=1608784418

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f78.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Apr 2018 17:54:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1302480
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.facebook.com/impression.php/f3f355891c2f39c/ 43 B
200 B 71ms
70ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/impression.php/f3f355891c2f39c/?api_key=727516617265205&lid=115&payload=%7B%22source%22%3A%22jssdk%22%7D

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
x-xss-protection: 0
pragma: no-cache
x-fb-debug: CnFp+1imzXW+/gQVhm6nbC1589DLCzAkczhB6SBNRvCxOlObfAWaqS7agR+ndaD/K3Go5WltFKyOSZUKxFcbqQ==
date: Tue, 01 May 2018 19:42:20 GMT
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D97%26pixelIndex%3D0%26r%3D340640%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.theregister.co.uk...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D97%2526pixelIndex%253D0%2526r%253D340640%2526tzOffset%253...
https://a.dpmsrv.com/dpmpxl/index.php?id=1976936780374796183&q=xImp&v=1.x&cl=97&pixelIndex=0&r=340640&tzOffset=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reload...

256 B
957 B

439ms
110ms

Script
text/javascript

52.4.183.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?id=1976936780374796183&q=xImp&v=1.x&cl=97&pixelIndex=0&r=340640&tzOffset=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&_=1525203740686
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: HTTP/1.1
Server: 52.4.183.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-183-229.compute-1.amazonaws.com
Software: /
Resource Hash: 85d1408e285ee18ac03f56582a27d731dc2717a37123383549041c417e5a28a3

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 224
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 01 May 2018 19:42:22 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 311.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.73:80
AN-X-Request-Uuid: 76bcbece-c855-4c09-bdde-812de542e16f
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://a.dpmsrv.com/dpmpxl/index.php?id=1976936780374796183&q=xImp&v=1.x&cl=97&pixelIndex=0&r=340640&tzOffset=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&_=1525203740686
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 67 KB
25 KB 5ms
5ms Script
text/javascript 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f2.1e100.net

Software

cafe /

Resource Hash

a548f5420671f82f3270504e2a50583c238fbd970d931aa6a55c392665f2c253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:36:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 25320
x-xss-protection: 1; mode=block
server: cafe
etag: 5939525380388013013
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 01 May 2018 20:36:51 GMT

GET
S 200 60544172_a9ad36e3bcecd2680e5c6770a58925a8_creative_def.js Show response
s0.2mdn.net/ads/richmedia/studio/creative/60553309/ Frame 118D 4 KB
1 KB 40ms
19ms Script
text/javascript 172.217.22.38
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/creative/60553309/60544172_a9ad36e3bcecd2680e5c6770a58925a8_creative_def.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

sffe /

Resource Hash

35d4bc78eb82304fcd1b14948294c3614b5c12d423b49ca5744daf3d7f509a3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 18:32:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4216
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1270
x-xss-protection: 1; mode=block
last-modified: Thu, 08 Mar 2018 13:29:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 May 2018 18:32:04 GMT

GET
S 200 html_inpage_rendering_lib_200_230.js Show response
s0.2mdn.net/879366/ Frame 118D 174 KB
60 KB 34ms
13ms Script
text/javascript 172.217.22.38
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_230.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

sffe /

Resource Hash

da9e149af8dde3e2095c3c425863c306a53f54e35a0cbeac2db928d6a299fb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 16:17:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12301
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 61531
x-xss-protection: 1; mode=block
last-modified: Fri, 02 Mar 2018 12:08:26 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 May 2018 16:17:19 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180425/r20110914/activeview/ Frame 118D 67 KB
24 KB 6ms
6ms Script
text/javascript 172.217.22.65
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180425/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

172.217.22.65 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f65.1e100.net

Software

cafe /

Resource Hash

fc90b07792a4aebc05e3f5852bb6ff3474f715322f36c42972d82f7d5a0d6e3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Wed, 25 Apr 2018 16:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 529504
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 24838
x-xss-protection: 1; mode=block
server: cafe
etag: 4917680001186161554
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 May 2018 16:37:16 GMT

GET
S 200 60544169_eebf22078bd5a20c6472bd4ba873184c_creative_def.js Show response
s0.2mdn.net/ads/richmedia/studio/creative/60557381/ Frame 77D1 4 KB
1 KB 34ms
17ms Script
text/javascript 172.217.22.38
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/creative/60557381/60544169_eebf22078bd5a20c6472bd4ba873184c_creative_def.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

sffe /

Resource Hash

bb1882437e1e676be9698aa16cdc14e326330246ed3ad2c37522c9e8e1608433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 17:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8382
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1273
x-xss-protection: 1; mode=block
last-modified: Thu, 08 Mar 2018 13:29:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 May 2018 17:22:38 GMT

GET
S 200 html_inpage_rendering_lib_200_230.js Show response
s0.2mdn.net/879366/ Frame 77D1 174 KB
60 KB 18ms
2ms Script
text/javascript 172.217.22.38
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_230.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

sffe /

Resource Hash

da9e149af8dde3e2095c3c425863c306a53f54e35a0cbeac2db928d6a299fb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 16:17:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12301
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 61531
x-xss-protection: 1; mode=block
last-modified: Fri, 02 Mar 2018 12:08:26 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 May 2018 16:17:19 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180425/r20110914/activeview/ Frame 77D1 67 KB
24 KB 10ms
8ms Script
text/javascript 172.217.22.65
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180425/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_199.js

Protocol

SPDY

Server

172.217.22.65 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f65.1e100.net

Software

cafe /

Resource Hash

fc90b07792a4aebc05e3f5852bb6ff3474f715322f36c42972d82f7d5a0d6e3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Wed, 25 Apr 2018 16:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 529504
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 24838
x-xss-protection: 1; mode=block
server: cafe
etag: 4917680001186161554
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 May 2018 16:37:16 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 118D 0
245 B 21ms
20ms Image
text/html 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst4lmoUtMhpvvzHsWGOCeN0MkybgXQgs8xTVw1aFlzJ7wcM0QoG70RGpNk95zOgIWgHqCsDzw53aTCSukWfYbpaF1WCfnUp7tEXEea6EiHutK1_No42Js8QHnZGNlgaiCoovgIoURNwVTpes3Vdigi3h7OD2C1y0hNIucergBNMfQRdC3NM3r7sGntBZa7XlHV2f4jEYSp-Vaj1JFdF8sn0DfisbP6fV-F5acjTFLxLYagLF4CoWSTjq-8rQ0944HNqPTqa-E_HNNW5g4MJ4YO3&sig=Cg0ArKJSzINRzod6F4DUEAE&urlfix=1&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f34.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 01 May 2018 19:42:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77D1 0
246 B 22ms
21ms Image
text/html 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvVw7LcQy4AMZPgvEfYIens30ZY1WqxOq-vwnjHxIg-M17teXLXwYqQMYdR7wDlVyYfYJdzaL2vvDGbj5PLf0IX215ddpxv5499DraJOzWRiy71RXQOcA5u6_l7Cnn6uTobgyvwGwq2nUZQOdPnb-lNH7lEN1oYBluJI4ufEre-z452OPVFThNNoqNe3469yoiPMeNi2ofvCtMH2nw6BaBhXWFLCg_-j6q_eb2CUs9YkLO_lY_kQy5S9vsVJDvNaKZyghqXbooDlHawpTqtPwvk&sig=Cg0ArKJSzO6GkIUGJLI6EAE&urlfix=1&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/

Protocol

SPDY

Server

172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f34.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 01 May 2018 19:42:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 19:42:20 GMT

GET
DATA 200
OK truncated
/ Frame 118D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30a850f52cb19885271ab15415d82b8ef96b5e2eb2fc9e9bac886d92e3ab2969

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 77D1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f40125e9a809b67f9bfd0d0fa85543c6a6195bc3b9ac11bdd8f2d17c926aafac

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687&google_gid=CAESEHk_gG0fjTSOEb8PbDlGksE&google_cver=1

0
575 B

109ms
109ms

Script
text/javascript

52.4.183.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687&google_gid=CAESEHk_gG0fjTSOEb8PbDlGksE&google_cver=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: HTTP/1.1
Server: 52.4.183.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-183-229.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 0
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 01 May 2018 19:42:21 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1976936780374796183&pixelIndex=0&_=1525203740687&google_gid=CAESEHk_gG0fjTSOEb8PbDlGksE&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 368
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

362248.gif
idsync.rlcdn.com/
Redirect Chain

https://idsync.rlcdn.com/423396.gif?partner_uid=1976936780374796183
https://idsync.rlcdn.com/423396.gif?partner_uid=1976936780374796183&redirect=1
https://dpm.demdex.net/ibs:dpid=477&dpuuid=c4275147095fe4e45d67f391cf66834b945830eef6e31757db230953fc6c9485b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BD...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=477&dpuuid=c4275147095fe4e45d67f391cf66834b945830eef6e31757db230953fc6c9485b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3...
https://idsync.rlcdn.com/362248.gif?partner_uid=06418089830522097723720935366522501338

43 B
652 B

109ms
109ms

Image
image/gif

34.198.128.122
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362248.gif?partner_uid=06418089830522097723720935366522501338
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: HTTP/1.1
Server: 34.198.128.122 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-198-128-122.compute-1.amazonaws.com
Software: /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store
Connection: keep-alive
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Content-Length: 43
Content-Type: image/gif; charset=ISO-8859-1

Redirect headers

Pragma: no-cache
Date: Tue, 01 May 2018 19:42:21 GMT
X-TID: O9+uVkXfSCc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://idsync.rlcdn.com/362248.gif?partner_uid=06418089830522097723720935366522501338
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 2009 00:00:00 GMT

GET
H2

200

tp.gif
regmedia.co.uk/2007/09/13/
Redirect Chain

https://go.theregister.co.uk/k/abt_a
https://regmedia.co.uk/2007/09/13/tp.gif

49 B
204 B

15ms
15ms

Image
image/gif

104.20.202.52
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2007/09/13/tp.gif
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.20.202.52 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

:path: /2007/09/13/tp.gif
pragma: no-cache
cookie: __cfduid=d0818964c774da91634f626735e3268b11525203740
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: regmedia.co.uk
referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
:scheme: https
:method: GET
Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 19:42:21 GMT
cf-cache-status: HIT
cf-ray: 4144bb170f019712-FRA
status: 200
content-length: 49
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 13 Sep 2007 11:17:03 GMT
server: cloudflare
etag: "31-43a027a4c29c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: PFY02
expires: Sun, 26 May 2019 19:42:21 GMT

Redirect headers

date: Tue, 01 May 2018 19:42:21 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 302
content-type: text/html; charset=iso-8859-1
location: https://regmedia.co.uk/2007/09/13/tp.gif
x-reg-bofh: PFY02
cf-ray: 4144bb16ba9c6361-FRA
content-length: 310
cf-railgun: a66ca38901 stream 0.000000 0200 57da

GET
H/1.1 200
OK index.php Show response
a.dpmsrv.com/dpmpxl/ 5 B
1000 B 109ms
109ms Script
text/javascript 52.4.183.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=xSeg&v=1.x&ep%5Bids%5D=1501713&cl=97&pixelIndex=0&r=685470&tzOffset=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2018%2F04%2F09%2Foffice_file_attack_reloaded_in_exploit_builder%2F&id=1976936780374796183&_=1525203740688
Requested by: Host: s.dpmsrv.com
URL: https://s.dpmsrv.com/dpm_812ed4562d3211363a7b813aa9cd2cf042b63bb2.min.js
Protocol: HTTP/1.1
Server: 52.4.183.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-183-229.compute-1.amazonaws.com
Software: /
Resource Hash: fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 31
Expires: 0

GET
H/1.1 200
OK seg
ib.adnxs.com/ 43 B
1 KB 13ms
13ms Image
image/gif 185.33.223.208
AppNexus

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/seg?member=827&add=1501713

Protocol

HTTP/1.1

Server

185.33.223.208 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 01 May 2018 19:42:24 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 311.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.50:80
AN-X-Request-Uuid: 5309288b-92f1-4ca2-ac6b-b3e560be236c
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 118D 42 B
116 B 14ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstZulo_w1zhjPvsriEu24LHEg4mH6b77osSh4D2OXIUERSG2f4-brhVCTp-zbY11cpv188TaBSg3WTkot0f0zIhLXWfWzU-Ii8&sig=Cg0ArKJSzEMzOZZyRKKVEAE&id=osdim&ti=1&r=v&adk=3919518880&tt=1016&bs=1585,1200&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&p=150,429,240,1157&mcvt=1015&rs=3&ht=0&tfs=1094&tls=2109&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,3541&ss=1600,1200&pt=1093&deb=1-3-3-10-17-4-57-13&tvt=2097&op=1&uc=27&tgt=BODY&cl=1&cec=9&clc=0&cac=0&cd=728x90&v=r20180425

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 19:42:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 77D1 42 B
116 B 14ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu_l4n57XDEXMCCryemr7j5FLxYM0PbfJYjCR1rADpqhQ6a8xc_rmk7LJ8vEeZzlde1pBbbh1pU3rCoJyCcFnKMvuppYnwNMfs&sig=Cg0ArKJSzBvkTuHPfW6OEAE&id=osdim&ti=1&r=v&adk=2610646818&tt=1016&bs=1585,1200&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&p=254,978,504,1278&mcvt=1015&rs=3&ht=0&tfs=1094&tls=2109&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,3541&ss=1600,1200&pt=1093&deb=1-3-3-10-17-4-57-13&tvt=2097&op=1&uc=27&tgt=BODY&cl=1&cec=9&clc=0&cac=0&cd=300x250&v=r20180425

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 19:42:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

173 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.theregister.co.uk/	1970-01-19 09:11:15	Name: __gads Value: ID=cfb0ef9b2bfddea4:T=1525203740:S=ALNI_MYT9RlayjCJVuYzwsDuJOoUZEe3Eg
www.theregister.co.uk/	1969-12-31 23:59:59	Name: dpm_time_site Value: 1.015
.theregister.co.uk/	1970-01-18 15:41:30	Name: _gid Value: GA1.3.1879928068.1525203740
www.theregister.co.uk/	1969-12-31 23:59:59	Name: dpm_url_count Value: 1
.theregister.co.uk/	1970-01-18 15:40:03	Name: _gat Value: 1
www.theregister.co.uk/2018/04/09/office_file_attack_reloaded_in_exploit_builder	1969-12-31 23:59:59	Name: hasLiveRampMatch Value: true
.theregister.co.uk/	1970-01-19 09:11:15	Name: _ga Value: GA1.3.675195297.1525203740
.theregister.co.uk/	1970-01-19 00:25:39	Name: bucket Value: 849
.theregister.co.uk/	1969-12-31 23:59:59	Name: sc Value: 1
.theregister.co.uk/	1970-01-19 00:25:39	Name: __cfduid Value: d264a3646419c3bfeb599ad025f9b91ee1525203739

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.dpmsrv.com
adservice.google.nl
cm.g.doubleclick.net
connect.facebook.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
go.theregister.co.uk
ib.adnxs.com
idsync.rlcdn.com
nir.regmedia.co.uk
pagead2.googlesyndication.com
platform.twitter.com
regmedia.co.uk
s.dpmsrv.com
s0.2mdn.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.googletagservices.com
www.theregister.co.uk
104.20.202.52
104.20.250.41
157.240.20.19
172.217.22.34
172.217.22.38
172.217.22.42
172.217.22.65
172.217.22.78
172.217.23.130
185.33.223.208
185.60.216.35
199.96.57.6
216.58.207.34
216.58.214.34
216.58.214.67
34.198.128.122
52.17.182.129
52.4.183.229
52.85.184.140
74.125.133.156
0035aca44e38761959d1c2ed3e1595c674ba23fc1a4b193ac7d20186fc6c9d1a
01ff76fb1f8b8a129013e8e720de39fa80a1b0f86206543a3f320dcd2508b206
0321c9599f54c12c28c60a11fa8feb36a0fc9a8613c835e2ec1362a778ba3814
11d4ad8af79a64a15b9e5e41ef02c6aba75a007fa7658782b1493925785a35db
1a427c31646c4dbcda43c5760eb5a224f5e695209d2bb6b1fb40229d6e5e1063
1a5fd3bf9fd1976777088488c7287b1c67ab24f08e0d5f21e130847e6075379c
1bcc748644049dde1e44f688701a961692e43867f689c0d407affbf5f2306523
1c806f79b6c2fcb659e5fe273bd96c2e4296833546d5619cebd12372da72dc6e
1c92a97edc483b14c28b1d2c2d0362358609079d1c15163883be5ee5d5a011ca
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
20279531a48af40077e7136437b5436017bed7a4c241e2f504f10a9ef08db6bd
2091888791c1939d27459b530ba9c819de971227d1b51b2524c66b4ff148f6b0
21170e3c0ccbaba33f2407165ff70dbfbea958375fe44b2f2f31e16df30dc512
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
2af698b9f65af1aa14b8c0d4101c7898e0396cedff30273f4a56c14c5f38358e
2e51745535bd5cb73477fed97637024c52ae004702a08f6cf4b8ed6b63f0eda0
304d91442457853506ff02213f922b9b69af88285fc329d01559db48ee8868d1
30a850f52cb19885271ab15415d82b8ef96b5e2eb2fc9e9bac886d92e3ab2969
35d4bc78eb82304fcd1b14948294c3614b5c12d423b49ca5744daf3d7f509a3b
384c00e8adcefac1d3c99c0262aa4d493e2b10c145a5d27390d1057bf96c8b0e
3d26b8433950bf918452f3913de7e092c5ce0d586d3f0903aad5e4e33dbdab0f
462bb86498f9167acfa5549972ca109dc228ec8149fda26f1ac74389ce8652c8
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ee897eecd34e335a2ff9fadd6d506529e2fedccba062c9a8836777c5538f274
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
58b7276b02814e0ee498a4a64e4d5e9374721c95732574b5ca4c053697a267dd
5b62faa59793bb8e2cab4da73edd1d8b25fb2a2777d923c474c2ddea678932a9
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace
637f5020eff2e5658ceb75c707c1a24ab3b6c3583637b24d9cf2d2ba1577ef9f
71451fe2d7b12a9b37b95ceb64843a3df8236b4cebe4d95ce99842334403b2df
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093
7e1549d8014a30c3c17fdca43be710f1c4acbe33706b008f7ef45b99f6b2bbe5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc
85d1408e285ee18ac03f56582a27d731dc2717a37123383549041c417e5a28a3
8b5da230ff3a1736c5b3c48a505bf91f355e1b8e13c1212ef60200792898d44a
90082aee0198e73e60371409463221b1cf611bc1bcf2e53061101d3210293b29
90f9d255b1f05bc80e84f82f7e2788d60b119de3ef73962bfdaf22a176e6326b
91e12566e30fcdd49adb5cb01baba9e9ce06d813e79a2f6494771e97a8ec5c44
96a01e89ced651607eb0f83151b1f6bee71cbd7fa9a706169c8a1f56f053b32b
a0807a505cb50c2ed34208a45f5ff7e12f8835d6580780636ebe22fcf91fb830
a1d79c5062d02c1f374aa186a22ccd3a3989bc8e281e3ed68349de57a504d426
a548f5420671f82f3270504e2a50583c238fbd970d931aa6a55c392665f2c253
a74143506db8f054666fc64b68a14c29eae0a3f0bf07999e557b4e1377e0d14b
ad743ae9b24b4f8de4039cc4449322a0651996d4f3eeb706fbc63fd4bc4d1822
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b7f5b5b43216fd88234498aca8d5ebc5caee078096112251a7a4303411f5850d
ba953e4946d5d141443d1128f8d12dd63ce9cb1ce765e2290cf1a3cb40b06021
bae12f858343f5babe0326e1fbb4c8b3038bd8a621066bbc3b34e8aebb7a574f
bb1882437e1e676be9698aa16cdc14e326330246ed3ad2c37522c9e8e1608433
bbccc31c6c7a8211b4c79d9c46bb523743319de6bbb32a2002c9fd3db3b003de
be04ee6479e67725d2dcd744cdacd0cc551e96d3a5318d0e6339fce3b0547839
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed
c53cd1749183aa230d84582dcf3f6b78d313fefbeceec5d21da2f87d078d8046
ce0367c7f081af862e738a8334086da28bc3d1fbc68f2d58b0208832bd4ecee8
d0ee2c86f2159021e4f1ab0e3fba452e8d8ed42aeab6cd4a0e6a366e5024ad17
d5abcf141f8f0f561f6bc7f92a156adb6a4e5725173bbd41778d12a591d90abf
d8afc52a8606259c4b1c70c6132aba5585d4b7ffcd6883be58396497c0ea58f7
da9e149af8dde3e2095c3c425863c306a53f54e35a0cbeac2db928d6a299fb36
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c70d52bb9a0b334013b32f8202fb2e6335582dbcd7fff6ddbe049a3afcbf8b
f0f8ee28575891a454e30946b1e00e91b0d8ebb0c0d016f9d58ca9d9e1793468
f195b9dec2d7806fdab73e49055244534d9fe1adc26d2294361877915f53a01d
f22c45cc7909516424404b7df16aad7ff0eec7007a7c31cf9f4c85cc1f70c9e5
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c
f40125e9a809b67f9bfd0d0fa85543c6a6195bc3b9ac11bdd8f2d17c926aafac
f9f1e0973cfcd3c9f396b9ccb8030e9416176c9a21c200552758369713e633a5
fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b
fc90b07792a4aebc05e3f5852bb6ff3474f715322f36c42972d82f7d5a0d6e3c

www.theregister.co.uk Open in urlscan Pro 104.20.250.41 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

76 Requests

34 %HTTPS

0 %IPv6

17 Domains

23 Subdomains

19 IPs

3 Countries

719 kBTransfer

1922 kBSize

10 Cookies

34 Outgoing links

Redirected requests

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.theregister.co.uk Open in urlscan Pro
104.20.250.41 Public Scan

Screenshot
Live screenshot

Full Image

76
Requests

34 %
HTTPS

0 %
IPv6

17
Domains

23
Subdomains

19
IPs

3
Countries

719 kB
Transfer

1922 kB
Size

10
Cookies

76 HTTP transactions
2 data transactions