arstechnica.com Open in urlscan Pro
3.20.147.38 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Submission: On March 25 via manual (March 25th 2020, 3:53:51 pm UTC) from US

Summary HTTP 158 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 49 IPs in 6 countries across 36 domains to perform 158 HTTP transactions. The main IP is 3.20.147.38, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is arstechnica.com.
TLS certificate: Issued by Amazon on January 26th 2020. Valid for: a year.

This is the only time arstechnica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	3.20.147.38 3.20.147.38	16509 (AMAZON-02) (AMAZON-02)
16	205.234.175.175 205.234.175.175	30081 (CACHENETW...) (CACHENETWORKS)
7	172.217.18.162 172.217.18.162	15169 (GOOGLE) (GOOGLE)
4	143.204.180.160 143.204.180.160	16509 (AMAZON-02) (AMAZON-02)
6	95.101.185.51 95.101.185.51	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	95.101.185.246 95.101.185.246	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.178.33 143.204.178.33	16509 (AMAZON-02) (AMAZON-02)
1	99.84.155.90 99.84.155.90	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6813:da83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
8	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
3	95.101.185.159 95.101.185.159	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	99.84.156.8 99.84.156.8	16509 (AMAZON-02) (AMAZON-02)
1	52.19.1.241 52.19.1.241	16509 (AMAZON-02) (AMAZON-02)
2	151.101.12.239 151.101.12.239	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6811:4032	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	63.35.59.66 63.35.59.66	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
1 3	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
3	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
9	152.195.132.202 152.195.132.202	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6812:db5d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	95.101.186.38 95.101.186.38	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	64.202.112.127 64.202.112.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
1	54.152.112.230 54.152.112.230	14618 (AMAZON-AES) (AMAZON-AES)
4	52.22.87.69 52.22.87.69	14618 (AMAZON-AES) (AMAZON-AES)
2	52.23.50.9 52.23.50.9	14618 (AMAZON-AES) (AMAZON-AES)
10	34.226.109.227 34.226.109.227	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.14.2 151.101.14.2	54113 (FASTLY) (FASTLY)
1 5	52.94.216.48 52.94.216.48	16509 (AMAZON-02) (AMAZON-02)
1	52.4.237.129 52.4.237.129	14618 (AMAZON-AES) (AMAZON-AES)
1	50.31.142.31 50.31.142.31	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	52.50.175.184 52.50.175.184	16509 (AMAZON-02) (AMAZON-02)
1	52.222.158.161 52.222.158.161	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
7 18	152.199.21.89 152.199.21.89	15133 (EDGECAST) (EDGECAST)
2	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT)
2	178.250.2.152 178.250.2.152	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
158	49

2 3.20.147.38 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-20-147-38.us-east-2.compute.amazonaws.com

arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 205.234.175.175 (United States)

ASN30081 (CACHENETWORKS, US)
PTR: vip1.G-anycast1.cachefly.net

cdn.arstechnica.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.18.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.180.160 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-180-160.lhr50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 95.101.185.51 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-51.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 95.101.185.246 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-246.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.178.33 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-178-33.lhr50.r.cloudfront.net

embed.actionbutton.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.155.90 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-155-90.txl52.r.cloudfront.net

player.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:da83 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
plugin.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.101.185.159 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-159.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.156.8 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-156-8.txl52.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.1.241 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-1-241.eu-west-1.compute.amazonaws.com

segment-data.zqtk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.12.239 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

pixel.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:4032 (United States)

ASN13335 (CLOUDFLARENET, US)

polarcdn-terrax.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.35.59.66 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-59-66.eu-west-1.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.59.101 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.67.47 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 152.195.132.202 (United States)

ASN15133 (EDGECAST, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:db5d (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.1trust.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 95.101.186.38 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-186-38.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.152.112.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-152-112-230.compute-1.amazonaws.com

srv-2020-03-25-15.config.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.22.87.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-87-69.compute-1.amazonaws.com

infinityid.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wren.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.23.50.9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-23-50-9.compute-1.amazonaws.com

4d.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.226.109.227 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-226-109-227.compute-1.amazonaws.com

capture.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.94.216.48 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.4.237.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-237-129.compute-1.amazonaws.com

srv-2020-03-25-15.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.31.142.31 (Chicago, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com

mcdp-chidc2.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.175.184 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-175-184.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.158.161 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-158-161.fra53.r.cloudfront.net

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 152.199.21.89 (United States) 7 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.152 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

an.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	advertising.com 7 redirects adserver-us.adtech.advertising.com	10 KB
18	condenastdigital.com pixel.condenastdigital.com infinityid.condenastdigital.com 4d.condenastdigital.com capture.condenastdigital.com wren.condenastdigital.com	22 KB
16	arstechnica.net cdn.arstechnica.net	643 KB
13	moatads.com z.moatads.com mb.moatads.com px.moatads.com	275 KB
9	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	537 KB
9	cookielaw.org cdn.cookielaw.org	165 KB
9	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net	95 KB
9	skimresources.com 1 redirects s.skimresources.com r.skimresources.com t.skimresources.com p.skimresources.com	18 KB
9	amazon-adsystem.com 1 redirects c.amazon-adsystem.com aax-eu.amazon-adsystem.com aax.amazon-adsystem.com	45 KB
8	outbrainimg.com tcheck.outbrainimg.com log.outbrainimg.com images.outbrainimg.com	67 KB
5	outbrain.com widgets.outbrain.com odb.outbrain.com mcdp-chidc2.outbrain.com	53 KB
4	casalemedia.com as-sec.casalemedia.com	2 KB
4	google-analytics.com www.google-analytics.com	19 KB
4	googletagservices.com www.googletagservices.com	97 KB
3	google.com 1 redirects adservice.google.com ampcid.google.com www.google.com	2 KB
2	criteo.com bidder.criteo.com	521 B
2	rubiconproject.com fastlane.rubiconproject.com	5 KB
2	parsely.com srv-2020-03-25-15.config.parsely.com srv-2020-03-25-15.pixel.parsely.com	886 B
2	google.de ampcid.google.de www.google.de	587 B
2	polarcdn-terrax.com polarcdn-terrax.com	595 B
2	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	21 KB
2	mediavoice.com cdn.mediavoice.com plugin.mediavoice.com	129 KB
2	indexww.com js-sec.indexww.com	37 KB
2	arstechnica.com arstechnica.com	15 KB
1	facebook.com an.facebook.com	1 KB
1	rlcdn.com api.rlcdn.com	203 B
1	rkdms.com mid.rkdms.com
1	adsrvr.org match.adsrvr.org	541 B
1	criteo.net static.criteo.net	30 KB
1	onetrust.com geolocation.onetrust.com	457 B
1	1trust.app geolocation.1trust.app	486 B
1	zqtk.net segment-data.zqtk.net	564 B
1	google.ch adservice.google.ch	839 B
1	googletagmanager.com www.googletagmanager.com	72 KB
1	cnevids.com player.cnevids.com api.cnevids.com Failed	28 KB
1	actionbutton.co embed.actionbutton.co	18 KB
158	36

	Domain	Requested by
18	adserver-us.adtech.advertising.com	7 redirects arstechnica.com
16	cdn.arstechnica.net	arstechnica.com
10	capture.condenastdigital.com	arstechnica.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org arstechnica.com
9	px.moatads.com	arstechnica.com
8	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net arstechnica.com
6	images.outbrainimg.com	arstechnica.com
5	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	as-sec.casalemedia.com	js-sec.indexww.com
4	pagead2.googlesyndication.com	arstechnica.com securepubads.g.doubleclick.net
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	c.amazon-adsystem.com	arstechnica.com c.amazon-adsystem.com
4	www.googletagservices.com	arstechnica.com securepubads.g.doubleclick.net
3	wren.condenastdigital.com	cdn.arstechnica.net
3	aax-eu.amazon-adsystem.com	1 redirects c.amazon-adsystem.com
3	t.skimresources.com	arstechnica.com s.skimresources.com
3	r.skimresources.com	1 redirects arstechnica.com
3	widgets.outbrain.com	cdn.arstechnica.net widgets.outbrain.com
3	z.moatads.com	arstechnica.com securepubads.g.doubleclick.net
2	bidder.criteo.com	static.criteo.net
2	fastlane.rubiconproject.com	js-sec.indexww.com
2	aax.amazon-adsystem.com	arstechnica.com
2	4d.condenastdigital.com	pixel.condenastdigital.com
2	p.skimresources.com	arstechnica.com
2	polarcdn-terrax.com	cdn.mediavoice.com plugin.mediavoice.com
2	pixel.condenastdigital.com	arstechnica.com
2	d1z2jf7jlzjs58.cloudfront.net	arstechnica.com d1z2jf7jlzjs58.cloudfront.net
2	js-sec.indexww.com	arstechnica.com
2	arstechnica.com	cdn.arstechnica.net
1	an.facebook.com	js-sec.indexww.com
1	api.rlcdn.com	js-sec.indexww.com
1	mid.rkdms.com	js-sec.indexww.com
1	match.adsrvr.org	js-sec.indexww.com
1	static.criteo.net	js-sec.indexww.com
1	mcdp-chidc2.outbrain.com	widgets.outbrain.com
1	srv-2020-03-25-15.pixel.parsely.com	arstechnica.com
1	odb.outbrain.com	widgets.outbrain.com
1	infinityid.condenastdigital.com	pixel.condenastdigital.com
1	srv-2020-03-25-15.config.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	geolocation.onetrust.com	cdn.cookielaw.org
1	log.outbrainimg.com	widgets.outbrain.com
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	geolocation.1trust.app	cdn.cookielaw.org
1	www.google.de	arstechnica.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	ampcid.google.de	www.google-analytics.com
1	ampcid.google.com	www.google-analytics.com
1	mb.moatads.com	z.moatads.com
1	plugin.mediavoice.com	cdn.mediavoice.com
1	segment-data.zqtk.net	arstechnica.com
1	adservice.google.com	www.googletagservices.com
1	adservice.google.ch	www.googletagservices.com
1	www.googletagmanager.com	arstechnica.com
1	s.skimresources.com	arstechnica.com
1	cdn.mediavoice.com	arstechnica.com
1	player.cnevids.com	arstechnica.com
1	embed.actionbutton.co	arstechnica.com
0	api.cnevids.com Failed	cdn.arstechnica.net
158	59

This site contains links to these domains. Also see Links.

Domain
video.arstechnica.com
cdn.arstechnica.net
www.microsoft.com
www.facebook.com
twitter.com
www.reddit.com
portal.msrc.microsoft.com
www.twitter.com
www.outbrain.com
opticshark.com
dailygadgetadvisor.com
om.elvenar.com
www.stayfriends.ch
gendings-stutory.icu
ad.doubleclick.net
condenast.com
www.condenast.com
onetrust.com

Subject Issuer	Validity	Valid
*.arstechnica.com Amazon	`2020-01-26` - `2021-02-26`	a year	crt.sh
*.cachefly.net GlobalSign RSA OV SSL CA 2018	`2020-02-06` - `2021-10-29`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.actionbutton.co Go Daddy Secure Certificate Authority - G2	`2019-06-25` - `2020-06-27`	a year	crt.sh
*.cnevids.com Amazon	`2020-01-22` - `2020-11-16`	10 months	crt.sh
ssl962336.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-12` - `2020-05-20`	6 months	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2018-09-13` - `2020-10-07`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.ch GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.zqtk.net COMODO RSA Domain Validation Secure Server CA	`2018-08-09` - `2020-08-24`	2 years	crt.sh
condenast.com GlobalSign CloudSSL CA - SHA256 - G3	`2019-10-31` - `2020-08-07`	9 months	crt.sh
ssl446800.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-02-21` - `2020-08-29`	6 months	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
www.google.de GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
sa437gl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-05-17` - `2020-08-19`	2 years	crt.sh
1trust.app CloudFlare Inc ECC CA-2	`2020-01-06` - `2020-10-09`	9 months	crt.sh
*.outbrainimg.com DigiCert SHA2 Secure Server CA	`2019-02-24` - `2020-05-25`	a year	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2018-03-12` - `2020-06-14`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.config.parsely.com Amazon	`2020-01-28` - `2021-02-28`	a year	crt.sh
*.conde.io Amazon	`2019-06-03` - `2020-07-03`	a year	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-03-03` - `2020-07-25`	5 months	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2019-09-18` - `2020-08-26`	a year	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2020-01-31` - `2020-04-30`	3 months	crt.sh
*.criteo.net DigiCert ECC Secure Server CA	`2019-12-03` - `2021-04-06`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2017-10-09` - `2020-10-30`	3 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.adtech.advertising.com DigiCert SHA2 High Assurance Server CA	`2018-05-22` - `2020-05-26`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.criteo.com DigiCert ECC Secure Server CA	`2019-12-05` - `2021-04-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh

This page contains 11 frames:

Primary Page: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Frame ID: AB67BBCEFA9A12A6612B6AD975518957
Requests: 148 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 19ABCC14C9744F814994F476DFA85DA4
Requests: 1 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.8829717446786425
Frame ID: CCD5A4A3339DF07A26A32DD14580BBEF
Requests: 1 HTTP requests in this frame

Frame: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Frame ID: 46E4713CF7F199D3FD098E4AB648A3B1
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Frame ID: 8AF3ED38D693B1D0FD721AA5C731B80B
Requests: 1 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift&dcc=t
Frame ID: A9C4797D1ED31814D30CBC66F41E11B8
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: 8E9FA71AAFE92AFBB012351E796D44B8
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUN74VluPANDa1irYIIE3M-1GdyDqGMN567R7HrhxbINtYhi86yBc-J3ZX8vUV1wE4DLkcouTwhm-keJJiXPxbcxG8kBacOggB5lNjAuI4VIBsbvAgP1KSuHgPab1TXPQylJ1Y50FeqrrgkurwB_-UNcuOdaZ_lIFolzdlp1jdTBNVhP_kOjkVowDJs6dnUR950KG44K99fLBft_It4oZwRipT0mjlTGyRw8SpMdV6z5teJ9PZQ_FH0ltG3ErT6A-hnn5iaxqfApfaYenz_EYPc-9IH8o7W5LykRhofLWtiBhwHg&sai=AMfl-YTPYqQXAAMp9I3_OyRqDXmttoC7tsEDs31b6tBmCDSh4hlz_3JzFG_qzG5_4ZEaur5wYlOZw27EV9jX9DhFMxltHW_1etVV65jtL3Vj&sig=Cg0ArKJSzJU-Pmy7za8PEAE&adurl=
Frame ID: 82FB767940E0D58C50BE7A2EFD72EDF9
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLlf4Tp7aEl51-IEX7AaiYwGSnCZ0sALJ_L4TUZuiz_YyEfykL5viJApib41aek-NdkSEJEf6tB25LTrOWOh5K9wAmyZG51caDK5ztv_HuUMS_4UxVX_WjrgmxhCKCK5fTxdvjOa38Jf6yZzqaxyAYHOm_fay274GkAWanhoxe7iZ5hAvba4eFhtNTWOVqDdClb1KRd-MDGxaOUGqI_NGNp25StDViVBJM-cGfKy9gd4-jfgyEs_s9Qnf9qXFJpCuoAmDprQLNybbAk_1xrz1TA1DrcdK6bF733NSrmB8Jhx3RlUkvkA&sai=AMfl-YQ0tpCDh-Ox3XDrW5NnZToxA13u4Dhcn56LR2PxA3saZevrsepDLbs4D6EYjgAq8QCwObzoTfmwiEpck7t-4uQ978jj4QZAi5kssWWETQ&sig=Cg0ArKJSzC6uHuCfd8-LEAE&urlfix=1&adurl=
Frame ID: 8C3E747FB7C0CBF2FDB3804FAE3A4F0E
Requests: 8 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/e/dtb/admi?b=ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y&rnd=2382025889441585151601264&pp=15xfn5s&p=3ai6m8&crid=2676:36208491
Frame ID: 065AAC7CD98B9966D107A972CB0B8816
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 95F3C3500EA42124774A6EED9A894034
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

158
Requests

99 %
HTTPS

32 %
IPv6

36
Domains

59
Subdomains

49
IPs

6
Countries

2406 kB
Transfer

5711 kB
Size

3
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: http://video.arstechnica.com/
Title: Videos

Search URL Search Domain Scan URL

URL: https://cdn.arstechnica.net/wp-content/uploads/2019/07/windows-10-s-wallpaper.jpg
Title: Enlarge

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/windows
Title: Windows

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1662596
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Windows+code-execution+zeroday+is+under+active+exploit%2C+Microsoft+warns&url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1662596
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1662596&title=Windows+code-execution+zeroday+is+under+active+exploit%2C+Microsoft+warns
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv200006#ID0EMGAC
Title: advisory published on Monday morning

Search URL Search Domain Scan URL

URL: https://www.twitter.com/dangoodin001
Title: @dangoodin001

Search URL Search Domain Scan URL

URL: http://www.outbrain.com/what-is/default/en
Title: Powered by

Search URL Search Domain Scan URL

URL: https://opticshark.com/?logstash=6d4a827f69420cdbc2592f6fc0fab007b2878511&campaign_id=00d02213058d723e37b2458e13476a4904&campaign_name=OT-CH-Desk-Dental-Implants1&source_id=$section_id$&source_name=$section_name$&publisher_id=$publisher_id$&publisher_name=$publisher_name$&click_id=$ob_click_id$&campaign_item_id=0008571a5a168578554e0182de57759c0c&campaign_item_title=Sehen+Sie%2C+was+Zahnimplantate+kosten+sollten&req_id=$req_id$&android_id=$android_id$&ios_id=$idfa$
Title: Sehen Sie, was Zahnimplantate kosten solltenZahnimplantate | Gesponserte Links

Search URL Search Domain Scan URL

URL: https://dailygadgetadvisor.com/tocwatch-de-t
Title: Unglaubliche Smartwatch für unter 100€ erobert Zurich im Sturm (absolut genial)Daily Gadget Advisor

Search URL Search Domain Scan URL

URL: https://om.elvenar.com/ox/de/?ref=out_de_ch&pid=$origpubname$&external_param=$origsrcname$&bid=00859a0541045a310842255ac6cee82732
Title: Wenn du gerne spielst, ist dieses Fantasiespiel ein Muss. Kein Install.Ein kostenloses Fantasiespiel

Search URL Search Domain Scan URL

URL: https://www.stayfriends.ch/sfvc/inboundlinks/ADB2Z?ABBZ=16672&AFBZ=3799d045eaea6b70a41da88e6d2008ef27afdaaa_
Title: Klassenfotos von 1940-49, 1950-59, 1960-69, 1970-79, 1980-89, 1990-99 und den 2000ern. Finde Dein Klassenfoto.Stayfriends

Search URL Search Domain Scan URL

URL: https://gendings-stutory.icu/20b76bad-7346-4682-a91a-e44f8bc4d444?campaign=006b2cdd459474cc6a83479b94d13da10e&sourceid=$origsrcid$&adid=Wieso+jeder+in+%24%7Bregion%7D%24+diesen+Wifi-Booster+haben+will&sectionid=$section_id$&sectionname=$section_name$&publisherid=$publisher_id$&publishername=$publisher_name$&obclickid=$ob_click_id$&obsourceid=$section_id$
Title: Wieso jeder in Zürich diesen Wifi-Booster haben willWifi Ultra Boost

Search URL Search Domain Scan URL

URL: https://ad.doubleclick.net/ddm/clk/464297573;269166252;v
Title: AXA Motorradversicherung: Für unbeschwerte Fahrten auf zwei Rädern!AXA.CH

Search URL Search Domain Scan URL

URL: http://condenast.com/

Search URL Search Domain Scan URL

URL: https://www.condenast.com/user-agreement/
Title: User Agreement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/
Title: Privacy Policy and Cookie Statement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/#california
Title: Your California Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.condenast.com/online-behavioral-advertising-oba-and-how-to-opt-out-of-oba/#clickheretoreadmoreaboutonlinebehavioraladvertising(oba)
Title: Ad Choices

Search URL Search Domain Scan URL

URL: https://www.condenast.com/cookie-policy
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy#privacypolicy
Title: Privacy Policy and Cookie Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&gjid=224602891&_gid=1568552205.1585151598&_u=aGBAgUAjAAQC~&z=1056345317 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317&slf_rd=1&random=2103426328

Request Chain 56

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070

Request Chain 96

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift HTTP 302
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift&dcc=t

Request Chain 142

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 143

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 151

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 152

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 153

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 154

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 155

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

158 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/ 43 KB
14 KB 393ms
134ms Document
text/html 3.20.147.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.20.147.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-20-147-38.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 / PHP/7.3.16

Resource Hash

54b9054fe0e58b7312d1b6ce1e820111b5bd0d6dd1f40a9d90c08d37a039ce37

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: arstechnica.com
:scheme: https
:path: /information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Wed, 25 Mar 2020 15:53:17 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.17.9
x-powered-by: PHP/7.3.16
link: <https://arstechnica.com/wp-json/>; rel="https://api.w.org/"
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
content-encoding: gzip

GET
H2 200 main-532e43a155.css
cdn.arstechnica.net/wp-content/themes/ars/assets/css/ 334 KB
69 KB 87ms
27ms Stylesheet
text/css 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 5ad2dd79dd70a3e9c03fcb2644b3dec3852424e0c5010a9054012304efe35b82

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 70509
x-cf-tsc: 1583790232
x-cf2: H
last-modified: Mon, 09 Mar 2020 21:20:33 GMT
server: CFS 0215
x-cff: B
etag: W/"5e66b321-53851"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 5
accept-ranges: bytes
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 44 KB
15 KB 59ms
57ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

5ca7d09c7b5f99182df6f62007d187311d760eea88843a69e9c03320804084ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "466 / 714 of 1000 / last-modified: 1585081375"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:17 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 87 KB
25 KB 1128ms
55ms Script
application/javascript 143.204.180.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.180.160 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-180-160.lhr50.r.cloudfront.net
Software: Server /
Resource Hash: ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 09:26:16 GMT
content-encoding: gzip
server: Server
age: 23222
etag: 1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: LHR50-C1
accept-ranges: bytes
x-amz-cf-id: MEjEUCUWjkQufQXxsLbhGszcI3y-ghso5W4AwOIR0OGa0ObCcPvYtA==
via: 1.1 77b70daab6366766b49607e666ee5cb6.cloudfront.net (CloudFront)

GET
H/1.1 200
OK 183973-1558632223658.js Show response
js-sec.indexww.com/ht/p/ 131 KB
37 KB 3737ms
655ms Script
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 00bd8c0d8620137ed2914b1958e62e894392f208c2f989e158565d9bb508e2fb

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:21 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 15:50:46 GMT
Server: Apache
ETag: "763d2e-20bd1-5a1afd4e515bd"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 37951
Expires: Wed, 25 Mar 2020 16:53:21 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/condenastprebidheader987326845656/ 187 KB
66 KB 53ms
17ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0eb438ad4233f9cdadd2cf6e5e3544a29b1e693a03f45b0b9fa25e70f2675917

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 23:07:10 GMT
server: AmazonS3
x-amz-request-id: C4EB885645F7EADB
etag: "36eff026ea983609efb74e7f83fac3f5"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=12537
accept-ranges: bytes
content-length: 67412
x-amz-id-2: 0OuSBOQTL5bWL5GbKshqc8LH0N1zUvVKyRv9aIh2fHkVjjuH49AGM6AVvGrpdrcS27mrdbb8wc4=

GET
H2 200 ars-technica.min.js Show response
cdn.arstechnica.net/cns/ 137 KB
45 KB 100ms
40ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/cns/ars-technica.min.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

cb332c513481e682f5a087a5be5f3956277cc4f940568a872ab87c14ad536443

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cf3: H
x-amz-request-id: F6ACD5AC922B5F15
x-cf1: 14961:fC.fra2:co:1576089267:cacheN.fra2-01:H
status: 200
vary: Accept-Encoding
content-length: 44956
x-amz-id-2: Kjh0Ht12XB3xcDLUvhXMrwI1hUb22Gq/5Zqc4rVkFrr7S/Bed5deMLuOg8UoYeMpTAiwQkI4rSw=
x-cf-tsc: 1581020463
cf4ttl: 43200.000
x-cf2: H
expires: Thu, 26 Mar 2020 15:53:17 GMT
last-modified: Thu, 30 Jan 2020 22:03:26 GMT
server: CFS 0215
x-timer: S1580977994.385116,VS0,VE68
x-cff: B
etag: "06d02814d9b071f29951bf3adbc5eca2"
x-served-by: cache-bwi5026-BWI
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=86400
cf4age: 42468
x-amz-version-id: ztCM6GSJ.kG8cN67f93sCUGypNpsY0jZ
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.474
x-cache-hits: 0

GET
H2 200 ars-bcfee6c82a.ads.us.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 4 KB
2 KB 86ms
26ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/ars-bcfee6c82a.ads.us.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1581035284:cacheN.fra2-01:H
status: 200
content-length: 1415
x-cf-tsc: 1581035293
x-cf2: H
last-modified: Thu, 06 Feb 2020 21:26:43 GMT
server: CFS 0215
x-cff: B
etag: W/"5e3c8493-e66"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
accept-ranges: bytes
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 windows-10-s-wallpaper-800x450.jpg
cdn.arstechnica.net/wp-content/uploads/2019/07/ 17 KB
17 KB 27ms
26ms Image
image/jpeg 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.arstechnica.net/wp-content/uploads/2019/07/windows-10-s-wallpaper-800x450.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

a27ba461461cf227fad341e7e38f9e0f5d274734770950af435e8ff068ffa242

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: H
x-amz-request-id: BA7A816262830E3B
x-cf1: 14961:fC.fra2:co:1563987225:cacheN.fra2-01:H
status: 200
content-length: 17001
x-amz-id-2: yy1VbF/iD3lVMyu+NZ3O5zztJkZ7IrCqeqSHl/EnPoMr7TZZkJmp/S5gbBWJqe/MgRybuZjWc+w=
x-cf-tsc: 1584965667
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 21 Dec 2019 02:23:25 GMT
server: CFS 0215
x-cff: B
etag: "0807eb16e6b00958b8d3eb0bdb44fe2e"
x-frame-options: SAMEORIGIN
x-amz-version-id: null
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=4838400
cf4age: 9967
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
content-type: image/jpeg
x-cf-rand: 1.495
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 main-e8e6d92966.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 661 KB
215 KB 60ms
59ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 05a2975ca40e7d714018e9704c2d82812a8735f335f78a5f8d274203bc2976da

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 219284
x-cf-tsc: 1585088061
x-cf2: H
last-modified: Tue, 24 Mar 2020 19:31:06 GMT
server: CFS 0215
x-cff: B
etag: W/"5e7a5ffa-a552c"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
accept-ranges: bytes
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H/1.1 200
OK widget.min.js Show response
embed.actionbutton.co/widget/ 55 KB
18 KB 15478ms
31ms Script
application/javascript 143.204.178.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.actionbutton.co/widget/widget.min.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.178.33 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-178-33.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 015045182758a421636084e2a2e43027e6ba1dd7005a2ec231b08d63c72d0fd7

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 14:32:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 14:32:21 GMT
Server: AmazonS3
Age: 4864
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 e7601078ca7d890a563728b9673d0b84.cloudfront.net (CloudFront)
Cache-Control: no-cache
Transfer-Encoding: chunked
X-Amz-Cf-Pop: LHR50-C1
Connection: keep-alive
X-Amz-Cf-Id: 6zEbgUAz6OuUTIFYsLt_ac9HFOXWdaXDpe4lNCqxndCmhzSAZxC00Q==

GET
H/1.1 200
OK arstechnica.js Show response
player.cnevids.com/interlude/ 109 KB
28 KB 7550ms
48ms Script
text/javascript 99.84.155.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/interlude/arstechnica.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.84.155.90 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-155-90.txl52.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

02a9db289d960e3196e2269632ee772bbcb51333e9ab3503105ae7f3b1665062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Age: 16
X-Cache: Hit from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 27527
X-XSS-Protection: 1; mode=block
X-Request-Id: c54dc6ac-2b6f-4b1a-89d1-b418902b8422
X-Runtime: 0.013592
X-Backend-Node: 10.110.72.103
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"cb0784c08379701bfe30f63397cc1a81"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 9e9671d1669bd7a6c194fae423e5778d.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Pop: TXL52-C1
X-Amz-Cf-Id: WpgklZyYHKAcDC8ih5y9AdfNYinPzmboRV9uqur0rTcfat7yPyFSnA==

GET
H2 200 conde-asa-polar-master.js Show response
cdn.mediavoice.com/nativeads/script/condenastcorporate/ 5 KB
2 KB 45ms
21ms Script
text/javascript 2606:4700::6813:da83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 20426
status: 200
content-type: text/javascript
content-length: 2018
via: 1.1 varnish
server: cloudflare
cache-control: max-age=21600
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 2027393858 2026922605
x-country: DE
cf-ipcountry: DE
accept-ranges: bytes
cf-ray: 5799cdcd2f1d975a-FRA

GET
H2 200 100098X1555750.skimlinks.js Show response
s.skimresources.com/js/ 41 KB
16 KB 353ms
33ms Script
application/octet-stream 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 55953987d8104311838ce0414adb751e86b32a69a9cbb441381ef67f1c4bbbb2

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
last-modified: Thu, 12 Mar 2020 11:43:35 GMT
server: AmazonS3
x-amz-request-id: BC39B126C8641837
etag: "d061a130936c12bec6f7b673c7e2b811"
x-hw: 1585151597.cds042.pa1.hn,1585151597.cds024.pa1.c
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 15820
x-amz-id-2: Tz2wJJIKneq86HJkanzPUpZlAjQ91gXM4O/h3msFPkrnSJE9vk3Xrie5FW1U5ow1w5ynhyhqdf0=

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 299 KB
72 KB 17ms
15ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

72ff898f6d799030f097fb900d4a78a7ab005254a02e8f76f0455c1cfcc43497

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 73732
x-xss-protection: 0
last-modified: Wed, 25 Mar 2020 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 25 Mar 2020 15:53:17 GMT

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 109 B
839 B 30ms
15ms Script
application/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
839 B 31ms
17ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 167 KB
61 KB 1080ms
31ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62290
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:18 GMT

GET
H2 200 ads.js Show response
arstechnica.com/hotzones/src/ 0
502 B 130ms
129ms XHR
application/javascript 3.20.147.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/hotzones/src/ads.js

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.20.147.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-20-147-38.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 19:28:22 GMT
server: nginx/1.17.9
etag: "5e7a5f56-0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 357 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 economica-bold-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 25 KB
26 KB 74ms
24ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-bold-otf-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 25592
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020464
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-63f8"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.834
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 economica-regular-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 86ms
37ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-regular-otf-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 24264
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020464
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-5ec8"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 1.397
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H/1.1 200
OK outbrain.js Show response
widgets.outbrain.com/ 127 KB
43 KB 785ms
498ms Script
application/x-javascript 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:18 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 08:30:47 GMT
ETag: W/"1fbb3-KoHnezOYyT0SUusJEB8aDSXQE/s"
Vary: Accept-Encoding
Edge-Cache-Tag: widget-cheetah
Content-Type: application/x-javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,POST
Connection: keep-alive, Transfer-Encoding
Access-Control-Allow-Credentials: false
Timing-Allow-Origin: *

GET video_groups
api.cnevids.com/v1/ 0
0

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/ 6 KB
3 KB 1158ms
41ms Script
application/x-javascript 99.84.156.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.156.8 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-8.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: 2f17ab3ac118eeddb8ac29b08b41a35c0a5f6cdb4a94097c69a36569c5e4d87e

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 00:25:57 GMT
Content-Encoding: gzip
Age: 55637
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 16 Mar 2020 20:58:13 GMT
Server: nginx
ETag: "5e6fe865-19d2"
Content-Type: application/x-javascript
Via: 1.1 f66aaf2d9f6a8e65595a1e24d5f18bcd.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: TXL52-C1
X-Amz-Cf-Id: W0AmSzlZL1il4vs8loT_I_Lcur8RXzFxBix3y0ETWm4Kq-UZhV6WJQ==
Expires: Thu, 26 Mar 2020 00:25:57 GMT

GET
H/1.1 200
OK conde-nast Show response
segment-data.zqtk.net/ 759 B
564 B 173ms
43ms Script
application/javascript 52.19.1.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segment-data.zqtk.net/conde-nast?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.1.241 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-1-241.eu-west-1.compute.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 4c849d13455fdf6ce1e23a0b84be7e6e72fdb3691c77cf949368d6e86f6eb955

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 23 Mar 2020 19:40:37 GMT
Server: nginx/1.10.3 (Ubuntu)
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Content-Length: 269
Expires: Wed, 25 Mar 2020 19:40:37 GMT

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 19AB 0
0 3011ms
19ms Document
text/html 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Wed, 25 Mar 2020 15:53:20 GMT
Connection: keep-alive

GET
H/1.1 200
OK ars-technica.config.js Show response
pixel.condenastdigital.com/config/v2/production/ 6 KB
2 KB 1336ms
19ms Script
application/javascript 151.101.12.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/config/v2/production/ars-technica.config.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.239 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50ef3043544193fed57957cde3087cb24a4af2a605c37a6ddc4c11105ac7bbe0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
Content-Encoding: gzip
Age: 135111
Via: 1.1 varnish, 1.1 varnish
X-Cache: MISS, HIT
X-Cache-Hits: 0, 37
Connection: keep-alive
Content-Length: 1151
x-amz-id-2: ITo7KklX/OsJa28NOAepmGqGmZ5+ObSbbJ+qFh4ShK18ZAifo7V+hoXPpwsNJxUCVfRqYgi/z6o=
X-Served-By: cache-iad2135-IAD, cache-fra19175-FRA
Last-Modified: Wed, 05 Feb 2020 18:01:17 GMT
Server: AmazonS3
X-Timer: S1585151599.011165,VS0,VE0
ETag: "b2d7ed50cf3dbf4d93df75f579b3a6b4"
Vary: Accept-Encoding
x-amz-request-id: AD6C37A989D0117F
Access-Control-Allow-Origin: *
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
Expires: Tue, 25 Feb 2020 07:45:38 GMT

GET
DATA 200
OK truncated
/ 279 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 400 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 700 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 841 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 Dang.jpg
cdn.arstechnica.net/wp-content/uploads/2018/10/ 90 KB
91 KB 25ms
25ms Image
image/jpeg 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2018/10/Dang.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-cf3: H
x-amz-request-id: 430E27768B3BD7E4
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 92486
x-amz-id-2: 90HbMidU5mhVF+n38cxv6kRe5+meAlSHbK2widFA4NIWat6UYBvUdJCLOzhaSGmSsSTtVykP9sY=
x-cf-tsc: 1584315833
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 21 Dec 2019 01:48:48 GMT
server: CFS 0215
x-cff: B
etag: "03e5fec9e7ca5f8064d945bd791bd4c3"
x-amz-version-id: null
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 13104
accept-ranges: bytes
content-type: image/jpeg
x-cf-rand: 1.073
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 channel-ars-be7bb52ba9.png
cdn.arstechnica.net/wp-content/themes/ars/assets/img/ 5 KB
5 KB 24ms
24ms Image
image/png 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/img/channel-ars-be7bb52ba9.png

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 4809
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020463
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-12c9"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.084
expires: Wed, 20 May 2020 15:53:17 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 18 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 opensans-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 18 KB
19 KB 36ms
35ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-regular-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 18824
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020464
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-4988"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 1.680
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 bitter-italic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 25ms
24ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-italic-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 24212
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020464
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-5e94"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 1.993
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 bitter-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
23 KB 37ms
36ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-regular-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 22872
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020464
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-5958"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.811
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 opensans-semibold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
19 KB 37ms
36ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibold-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 18972
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020463
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-4a1c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.086
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 opensans-semibolditalic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 20 KB
21 KB 32ms
31ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibolditalic-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 20872
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020463
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-5188"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.853
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 opensans-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
20 KB 37ms
36ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-bold-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 19516
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020463
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-4c3c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 1.813
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 bitter-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
22 KB 28ms
28ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-bold-webfont.woff2

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status: 200
content-length: 22104
x-xss-protection: 1; mode=block
x-cf-tsc: 1581020463
x-cf2: H
last-modified: Mon, 03 Feb 2020 21:50:35 GMT
server: CFS 0215
x-cff: B
etag: "5e3895ab-5658"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 0.962
expires: Wed, 20 May 2020 15:53:17 GMT

GET
H2 200 plugin.js Show response
plugin.mediavoice.com/ 343 KB
127 KB 25ms
17ms Script
application/javascript 2606:4700::6813:da83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plugin.mediavoice.com/plugin.js
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cfd03c7324bff29a75eed9529fb31764b922489e32030d4acabea1cc5a216f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5119
cf-ray: 5799cdcde807975a-FRA
status: 200
content-length: 129661
via: 1.1 varnish
x-varnish: 2006918692 2006918688
last-modified: Mon, 23 Mar 2020 14:27:53 GMT
server: cloudflare
etag: W/"5e78c769-55b9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=43200
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Thu, 26 Mar 2020 02:27:58 GMT

GET
H2 200 condenastcorporate Show response
polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/ 181 B
595 B 43ms
26ms XHR
application/json 2606:4700::6811:4032
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/condenastcorporate
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
server: cloudflare
status: 200
etag: W/"4ed41fc03a3c3b67ac78af86ee19d7f1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Country, CF-Ray
cache-control: max-age=3600
x-country: DE
cf-ray: 5799cdcdf80ddff7-FRA

GET
H2 200 yi.js Show response
mb.moatads.com/ 1 KB
2 KB 202ms
113ms Script
text/html 63.35.59.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjhBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&confidence=2&pcode=condenastprebidheader987326845656&callback=MoatNadoAllJsonpRequest_32319296
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.35.59.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-35-59-66.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: c4320e6b2508b16ba78f8f90eb747e8927695a494a235f512f803b779618a7ac

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
server: TornadoServer/4.5.3
etag: "ec968575a46b847cc727e8f08cbfeb5ba245e2c4"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 1483

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 22ms
20ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&na=2007255812&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:17 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 4482
date: Wed, 25 Mar 2020 14:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Wed, 25 Mar 2020 16:38:35 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
19ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&na=1706812627&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:17 GMT

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
923 B 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:14:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2330
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:14:27 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
549 B 35ms
14ms XHR
application/json 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 94
x-xss-protection: 0

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
478 B 35ms
15ms XHR
application/json 2a00:1450:4001:81b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Mar 2020 15:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

POST
H2 200 collect
www.google-analytics.com/ 35 B
119 B 14ms
14ms Other
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: https://arstechnica.com
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&gjid=224602891&_gid=1568552205.1585151598&_u=aGBAgUAjAAQC~&z=1056345317
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317&slf_rd=1&random=2103426328

42 B
109 B

19ms
18ms

Image
image/gif

2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317&slf_rd=1&random=2103426328

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=1168255866.1585151598&jid=1093984427&_v=j81&z=1056345317&slf_rd=1&random=2103426328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2

307

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070

0
-1 B

65ms
27ms

XHR
text/html

35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://arstechnica.com
location: https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 307
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: text/html
alt-svc: clear
content-length: 193

Redirect headers

date: Wed, 25 Mar 2020 15:53:18 GMT
via: 1.1 google
server: openresty/1.11.2.5
status: 307
location: https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame CCD5 0
64 B 171ms
43ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.8829717446786425
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 206
date: Wed, 25 Mar 2020 15:53:18 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
495 B 35ms
34ms Image
image/gif 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=5.105304866090034
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
status: 200
x-guploader-uploadid: AEnB2UrWwWAkLAfNVpByVZ9AZt3DA6m4sR-WT0qA3iDluvXPPfpU8WZAEoBLWFFFEQgMpKeH4SIa2YBSFs6R0yBG3FMQskZQ7A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1585151598.cds042.pa1.hn,1585151598.cds041.pa1.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
107 B 34ms
34ms Image
image/gif 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=5.105304866090034
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
status: 200
x-guploader-uploadid: AEnB2UrWwWAkLAfNVpByVZ9AZt3DA6m4sR-WT0qA3iDluvXPPfpU8WZAEoBLWFFFEQgMpKeH4SIa2YBSFs6R0yBG3FMQskZQ7A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1585151598.cds042.pa1.hn,1585151598.cds041.pa1.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 /
polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/ Frame 46E4 0
0 30ms
15ms Document
text/html 2606:4700::6811:4032
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Requested by: Host: plugin.mediavoice.com
URL: https://plugin.mediavoice.com/plugin.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: polarcdn-terrax.com
:scheme: https
:path: /privacy/v1.0.0/html/optout/readwrite/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe

Response headers

status: 200
date: Wed, 25 Mar 2020 15:53:18 GMT
content-type: text/html; charset=utf-8
content-length: 1291
set-cookie: __cfduid=db1584088aec4c619c9db3fb518e36e491585151598; expires=Fri, 24-Apr-20 15:53:18 GMT; path=/; domain=.polarcdn-terrax.com; HttpOnly; SameSite=Lax
vary: Accept-Encoding
access-control-allow-headers: Authorization
access-control-expose-headers: CF-IPCountry, X-Country, CF-Ray
cache-control: max-age=900
access-control-allow-origin: *
access-control-allow-methods: GET
timing-allow-origin: *
content-encoding: gzip
x-varnish: 2028003631 2027980536
age: 232
via: 1.1 varnish
cf-cache-status: HIT
accept-ranges: bytes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5799cdcf9e5396ce-FRA

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 11 KB
4 KB 370ms
28ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C0C) /
Resource Hash: 8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: N1nkxqP8FRR4U7sOR6dsSg==
age: 4282
x-cache: HIT
status: 200
content-length: 3742
x-ms-lease-status: unlocked
last-modified: Wed, 18 Mar 2020 20:41:16 GMT
server: ECAcc (mil/6C0C)
etag: 0x8D7CB7CB4C4B02D
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 8881ad90-901e-017e-5fb3-02017c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 20ms
19ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=44&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=262&zMoatAllDataLoadTime=262&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&if=262&na=663246251&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:18 GMT

POST
H2 200 / Show response
r.skimresources.com/api/ 167 B
505 B 28ms
28ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01E496BQED9H96BBX4B4WG76CD&persistence=1&checksum=4959d5d21da41a7f8f88e3c93c03d614dee063b22996af33e4c1a5a2d7cc4070

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

973bbb07fc273e75591790d1bdfbd79c64efea26be4aaaa821942ce979ca1559

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: application/json
alt-svc: clear
via: 1.1 google

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
383 B 67ms
30ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
91 B 71ms
35ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

GET
H2 200 b10882a1-8446-4e7d-bfb2-ce2c770ad910.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ 2 KB
1 KB 114ms
29ms XHR
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/b10882a1-8446-4e7d-bfb2-ce2c770ad910.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C7E) /
Resource Hash: 0df18872a7d32620388cdc4df1e18acaa761a157830bbf8e258599352fa933fb

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: egjsK/D2d+BJxj1PL28vfg==
age: 1791
x-cache: HIT
status: 200
content-length: 754
x-ms-lease-status: unlocked
last-modified: Tue, 10 Mar 2020 22:30:57 GMT
server: ECAcc (mil/6C7E)
etag: 0x8D7C542B43D786A
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 03ad0cd6-301e-005e-1db9-022be5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 otCCPAiab.js Show response
cdn.cookielaw.org/opt-out/ 22 KB
6 KB 31ms
30ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6CC4) /
Resource Hash: 10c75f7c6402ea3c15ba35494f299a73e62877fca5786e50f18983243fa16873

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: GLZFlYkrNGqcBQA787bV9Q==
age: 4259
x-cache: HIT
status: 200
content-length: 5611
x-ms-lease-status: unlocked
last-modified: Wed, 18 Mar 2020 14:51:28 GMT
server: ECAcc (mil/6CC4)
etag: 0x8D7CB4BD6F4A8BF
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f9b8b813-b01e-0140-11b3-02b75d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 dnsfeed Show response
geolocation.1trust.app/cookieconsentpub/v1/geo/location/ 113 B
486 B 83ms
27ms Script
text/javascript 2606:4700::6812:db5d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.1trust.app/cookieconsentpub/v1/geo/location/dnsfeed

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:db5d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c89250469c4a6df401abf15a6bafed900638d24b7e497b9327124a59b80c0ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains; preload
content-type: text/javascript
status: 200
cf-ray: 5799cdd32863c29f-FRA
vary: Accept-Encoding

GET
H/1.1 200
OK Cookie set put.html
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 8AF3 0
0 19ms
18ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "c0311cf15c21ddda054005e92fad3f9e:1585128557.048626"
Last-Modified: Wed, 25 Mar 2020 08:30:07 GMT
Server: AkamaiNetStorage
Content-Length: 416
Cache-Control: max-age=604800
Date: Wed, 25 Mar 2020 15:53:18 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585151598~rv=28~id=b963a09632e1bb78b0a1ca4b47ec2cad; path=/; Expires=Wed, 25 Mar 2020 15:53:18 GMT; Secure; SameSite=None

GET
H/1.1 200
OK YXJzdGVjaG5pY2EuY29t Show response
tcheck.outbrainimg.com/tcheck/check/ 16 B
477 B 55ms
17ms XHR
application/json 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://tcheck.outbrainimg.com/tcheck/check/YXJzdGVjaG5pY2EuY29t

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
ETag: W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=19889
Date: Wed, 25 Mar 2020 15:53:18 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: false
Content-Length: 16
Expires: Wed, 25 Mar 2020 21:24:47 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 95ms
33ms XHR
application/javascript 143.204.180.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.180.160 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-180-160.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 08:05:57 GMT
content-encoding: gzip
vary: Origin
age: 28042
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 05 Mar 2020 08:28:46 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 0050c18ff4e0e872772088fcaf6414f4.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: LHR50-C1
x-amz-cf-id: RSTYURljk_MSSSlbh_drba8xcZaYPCjj9gGX7RcB6N2b0KZBx-amyg==

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 463ms
114ms XHR
application/json 64.202.112.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585151598602&sessionId=794669e7-b435-b2db-a3b2-97a9115a7e5f&url=arstechnica.com&cheqSource=1&cheqEvent=0&exitReason=2
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:19 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 87eadf864ec5d7ecce4307f96dbeadf2
Content-Length: 4
Expires: 0

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 115 B
457 B 41ms
27ms Script
text/javascript 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5799cdd35eb064cd-FRA

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/5.13.0/ 389 KB
94 KB 30ms
30ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6CCD) /
Resource Hash: 759cbd9881e14214af52dfb585ccf70ea59037598b67cc9cf6df7d3fea7abfd0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: av5EYi/+VJcKyIBzruXtUw==
age: 2283
x-cache: HIT
status: 200
content-length: 95775
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:49 GMT
server: ECAcc (mil/6CCD)
etag: 0x8D7BA2861DF0E68
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 26223d38-f01e-0061-56b8-029c39000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/ 122 KB
18 KB 31ms
31ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/en.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C5E) /
Resource Hash: 8379daabd87751a7da8f1ed0c4b558d62f7d19a01b72a7f50153c1ec95f4ac9a

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: oDldTv707db2pxAKcgGc8A==
age: 1002
x-cache: HIT
status: 200
content-length: 18348
x-ms-lease-status: unlocked
last-modified: Tue, 10 Mar 2020 22:31:07 GMT
server: ECAcc (mil/6C5E)
etag: 0x8D7C542BA1BB286
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 61d6e919-301e-011e-45bb-02445e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 418 B
717 B 59ms
58ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2828614792540242&correlator=1836787515138081&output=ldjh&impl=fifs&adsid=NT&eid=21065763%2C21065202%2C21065392&vrg=2020032301&guci=2.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Cinterstitial%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ists=1&prev_scp=pos%3Dinterstitial%26ctx_slot_type%3Dout_of_page%26ctx_slot_rn%3D0%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dout_of_page_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26amznbid%3D0%26amznp%3D0%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dattackers-exploit-windows-zeroday-that-can-execute-malicious-code%26cnt_tags%3Dexploits%252Cflaw%252Cmicrosoft-3%252Cvulnerabilities%252Cwindows%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C131103%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252C0lw01o%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cimc5qw%252Cfdf1wd%252Cf5u35n%252C65f9pd%252Ccymbhor-t09%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585151598&dt=1585151598750&dlt=1585151597441&idt=1284&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=0&adks=2746652139&ucis=1&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&dssz=40&icsg=2201841827840&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x1&msz=1585x1&ga_vid=1168255866.1585151598&ga_sid=1585151599&ga_hid=1228582819&fws=4&ohw=1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

6f01f7dcdca22c184910f18ce17a1947c69fd34b46106a8b8437a5ae092f2a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 208
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 67 KB
25 KB 28ms
28ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25048
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:18 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 20ms
7ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 419 B
384 B 58ms
57ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2828614792540242&correlator=1836787515138081&output=ldjh&impl=fifs&adsid=NT&eid=21065763%2C21065202%2C21065392&vrg=2020032301&guci=2.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars.native%2Clegacy%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=2x2&prev_scp=pos%3Dlegacy%26ctx_slot_type%3Dnative_xrail%26ctx_slot_rn%3D0%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dnative_xrail_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26amznbid%3D0%26amznp%3D0%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dattackers-exploit-windows-zeroday-that-can-execute-malicious-code%26cnt_tags%3Dexploits%252Cflaw%252Cmicrosoft-3%252Cvulnerabilities%252Cwindows%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C131103%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252C0lw01o%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cimc5qw%252Cfdf1wd%252Cf5u35n%252C65f9pd%252Ccymbhor-t09%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585151598&dt=1585151598760&dlt=1585151597441&idt=1284&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=661&adks=2072965525&ucis=2&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&dssz=41&icsg=2201841827840&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x0&msz=300x2&ga_vid=1168255866.1585151598&ga_sid=1585151599&ga_hid=1228582819&fws=516&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

ef2de29410b7099cade537d668b4b086df180df25c8a1a874648282d6054e785

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 206
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otCMP.js Show response
cdn.cookielaw.org/scripttemplates/5.13.0/ 16 KB
5 KB 35ms
35ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otCMP.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C24) /
Resource Hash: fd9ee23548e148a3798e79ae0553689b81675afe6791f53d5e8af20973e6a7b0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: cgEQ1F8+NKFKe9J6MXvYfw==
age: 3976
x-cache: HIT
status: 200
content-length: 5312
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:55 GMT
server: ECAcc (mil/6C24)
etag: 0x8D7BA2865557BD9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0468163e-401e-003c-18b4-026c3d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 iabData.json Show response
cdn.cookielaw.org/vendorlist/ 92 KB
17 KB 41ms
41ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/vendorlist/iabData.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C96) /
Resource Hash: 981898ccfc444d54beb452d380c685515410830fb12494784729fd1eaa68167f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: kf/kUmh1gsah5KhM3yzvvw==
age: 450682
x-cache: HIT
status: 200
content-length: 17115
x-ms-lease-status: unlocked
last-modified: Sat, 14 Mar 2020 06:00:11 GMT
server: ECAcc (mil/6C96)
etag: 0x8D7C7DCF4F45245
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 643a3588-f01e-00a6-4ea4-fee0f8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
37ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=_out_of_page_0&zMoatRendered=1&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=1&zMoatSafetyTargetingSet=1&zMoatEmptySlot=1&zMoatNadoDataLoadTime=262&zMoatAllDataLoadTime=262&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&if=262&na=1712186349&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:18 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 542 B
741 B 393ms
393ms XHR
text/javascript 143.204.180.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=3035&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pid=Rs2i2qqtjsHpk&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22rail%2Fdesktop%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22hero%2Fdesktop%22%7D%5D&pj=%7B%22si_section%22%3A%22information-technology%22%2C%22us_privacy%22%3A%221---%22%7D&cfgv=0&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.180.160 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-180-160.lhr50.r.cloudfront.net
Software: Server /
Resource Hash: 9ade9bd9e08fd903669cbadd1c2ab4a8ad90e0cb5751ddff7bf871bdbca007b0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:19 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: LHR50-C1
status: 200
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 365
via: 1.1 77b70daab6366766b49607e666ee5cb6.cloudfront.net (CloudFront)
x-amz-cf-id: ecO5zFcjS-9XxSC6IzrplhryIRr3BAWcFDOnlXot9lbQqih4Yqj-SQ==

GET
H/1.1 200
OK arstechnica.com Show response
srv-2020-03-25-15.config.parsely.com/config/ 415 B
657 B 486ms
119ms Script
text/javascript 54.152.112.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2020-03-25-15.config.parsely.com/config/arstechnica.com
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.112.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-112-230.compute-1.amazonaws.com
Software: / Express
Resource Hash: 94ce6dc0280d294f50270522b9053bd8b9da26fa47c8641b20a6aca108fb39b2

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
Cache-Control: private, no-cache
Connection: keep-alive
X-Powered-By: Express
ETag: W/"19f-212aBJsJa4GTG8DnrhUUqQ"
Content-Length: 415
Content-Type: text/javascript; charset=utf-8

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/5.13.0/assets/ 15 KB
3 KB 43ms
43ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/assets/otFlat.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6CB6) /
Resource Hash: f52e4e999a441c151183d77efd6dad3915e650409ea65b94b7e0fc067dcd0abd

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: idLIfkDq/eva4EuRGVQzZQ==
age: 4266
x-cache: HIT
status: 200
content-length: 2839
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:47 GMT
server: ECAcc (mil/6CB6)
etag: 0x8D7BA28607C070E
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 49b0f5fe-001e-0134-61b3-02311b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/5.13.0/assets/ 84 KB
17 KB 43ms
43ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/assets/otPcCenter.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C4C) /
Resource Hash: 2bd6c30a523ce8b33d96dc79b1d759b5d5634740ae76aa6557e2d3741082e067

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 15:53:18 GMT
content-encoding: gzip
content-md5: Bbq+cqhXBxu2QqVrgDpPqg==
age: 4264
x-cache: HIT
status: 200
content-length: 17012
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:47 GMT
server: ECAcc (mil/6C4C)
etag: 0x8D7BA28609F260F
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 38323841-101e-00a7-35b3-02e105000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 19:53:18 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 34ms
33ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=native_xrail_0&zMoatRendered=2&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=2&zMoatSafetyTargetingSet=2&zMoatEmptySlot=2&zMoatNadoDataLoadTime=262&zMoatAllDataLoadTime=262&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&if=262&na=561772248&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:18 GMT

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK sparrow.min.js Show response
pixel.condenastdigital.com/ 38 KB
14 KB 18ms
18ms Script
application/javascript 151.101.12.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/sparrow.min.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.239 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a4a43521cee4006a9d54ffc1e769752ea89ea213e5474e886a32a5b7613163c3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
Content-Encoding: gzip
Age: 2088
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1, 60
Connection: keep-alive
Content-Length: 13530
x-amz-id-2: V7K8JplftiA2s1suZXvyVzNbacQoab1VNwREgJOCYWoFuujHKSy99OilwFaojZkynDTbjoCTSmI=
X-Served-By: cache-iad2149-IAD, cache-fra19175-FRA
Last-Modified: Wed, 05 Feb 2020 15:16:27 GMT
Server: AmazonS3
X-Timer: S1585151599.030517,VS0,VE0
ETag: "e6435598257a425dcb2054251b81b21a"
Vary: Accept-Encoding
x-amz-request-id: AD73D82969378DC2
Access-Control-Allow-Origin: *
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
Expires: Wed, 05 Feb 2020 21:18:34 GMT

GET
H/1.1 200
OK / Show response
infinityid.condenastdigital.com/ 36 B
1 KB 590ms
115ms XHR
text/plain 52.22.87.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://infinityid.condenastdigital.com/?rand=1585151599052
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.87.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-87-69.compute-1.amazonaws.com
Software: nginx/1.15.8 /
Resource Hash: 49e94b0178df842a0dd066aad529f61d2bf0baf48a21430d86e726d402e1019c

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
content-encoding: gzip
Server: nginx/1.15.8
vary: origin,accept-encoding
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
transfer-encoding: chunked

GET
H/1.1 200
OK content Show response
4d.condenastdigital.com/ 4 KB
2 KB 491ms
127ms XHR
application/json 52.23.50.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/content?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.23.50.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-23-50-9.compute-1.amazonaws.com
Software: /
Resource Hash: beda5f60d367081085605ed76d41af63900d5afdab50d9dc5f1377af32e622c1

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
content-encoding: gzip
transfer-encoding: chunked
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
Connection: keep-alive

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 456ms
111ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A19.053Z&_t=pubadsReady&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3900&pSw=1600&pSh=1200&uID=8a96dc04-06b9-4983-91e9-3365353832bd&uNw=1&uUq=1&sID=f5f202fc-509c-494f-a66c-e10703784428&pID=5488aa4c-1f8b-42b8-9f1d-550ce01aa3f0&uDt=desktop&dim1=%7B%22runtimeId%22%3A%22GzCmVqaUP4y9L%22%2C%22pageContext%22%3A%7B%22contentType%22%3A%22article%22%2C%22templateType%22%3A%22article%22%2C%22channel%22%3A%22information-technology%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%2C%22server%22%3A%22production%22%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%7D%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=ad_metrics&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:19 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 571ms
114ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A19.058Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3900&pSw=1600&pSh=1200&uID=8a96dc04-06b9-4983-91e9-3365353832bd&sID=f5f202fc-509c-494f-a66c-e10703784428&pID=5488aa4c-1f8b-42b8-9f1d-550ce01aa3f0&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22_out_of_page_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Atrue%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22out_of_page_0%22%2C%22outOfPage%22%3Atrue%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%221x1%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151598819%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22interstitial%22%5D%2C%22ctx_slot_type%22%3A%5B%22out_of_page%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22out_of_page_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:19 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 683ms
111ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A19.064Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3900&pSw=1600&pSh=1200&uID=8a96dc04-06b9-4983-91e9-3365353832bd&sID=f5f202fc-509c-494f-a66c-e10703784428&pID=5488aa4c-1f8b-42b8-9f1d-550ce01aa3f0&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars.native%2Flegacy%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22native_xrail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22native_xrail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%222x2%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151598823%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22legacy%22%5D%2C%22ctx_slot_type%22%3A%5B%22native_xrail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22native_xrail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:19 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 get Show response
odb.outbrain.com/utils/ 15 KB
10 KB 570ms
276ms Script
text/x-json 151.101.14.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://odb.outbrain.com/utils/get?url=http%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&srcUrl=http%3A%2F%2Ffeeds.arstechnica.com%2Farstechnica%2Findex%2F&settings=true&recs=true&widgetJSId=JS_1&key=NANOWDGT01&idx=0&version=1050170&apv=false&sig=QpRodSoE&format=vjapi&va=true&rand=43920&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&cmpStat=1&ccpaStat=1&ref=

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d262ea4abf9d2cca72b80812807123b883165d3404d384a58fd950021568fb98

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=0; includeSubDomains;
content-encoding: gzip
traffic-path: CHIDC2, MDW, FRA, Europe2
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status: 200
x-traceid: 47bcca62cf5ecccb65db66666d0acddb
content-length: 9117
x-served-by: cache-mdw17381-MDW, cache-fra19182-FRA
pragma: no-cache
x-timer: S1585151599.442810,VS0,VE254
date: Wed, 25 Mar 2020 15:53:19 GMT
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache
backend-ip: 157.52.75.81
accept-ranges: bytes, bytes
x-cache-hits: 0, 0

GET
H/1.1

200
OK

Cookie set iu3
aax-eu.amazon-adsystem.com/s/ Frame A9C4
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift&dcc=t

0
0

207ms
207ms

Document
text/html

52.94.216.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift&dcc=t
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.216.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash

Request headers

Host: aax-eu.amazon-adsystem.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ad-id=AwzKDOXjGECujKzSNB1XhRE|t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

Server: Server
Date: Wed, 25 Mar 2020 15:53:19 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 194
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Set-Cookie: ad-id=AwzKDOXjGECujKzSNB1XhRE; Domain=.amazon-adsystem.com; Expires=Thu, 01-Oct-2020 15:53:19 GMT; Path=/; Secure; HttpOnly; SameSite=None ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Tue, 01-Apr-2025 15:53:19 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip

Redirect headers

Server: Server
Date: Wed, 25 Mar 2020 15:53:19 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=ym_rbd_oath_dm_3lift&dcc=t
Set-Cookie: ad-id=AwzKDOXjGECujKzSNB1XhRE|t; Domain=.amazon-adsystem.com; Expires=Thu, 01-Oct-2020 15:53:19 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: User-Agent

GET
H/1.1 200
OK ptrack-v1.4.1-dev.4-engagedtime-slots.js Show response
d1z2jf7jlzjs58.cloudfront.net/code/ 46 KB
18 KB 40ms
39ms Script
application/x-javascript 99.84.156.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/code/ptrack-v1.4.1-dev.4-engagedtime-slots.js
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.156.8 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-8.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: 6971adb7fc147ab4028012f8c0afa86bfad4101212c5881d1aab7c2fa6977b39

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 17 Feb 2020 23:03:52 GMT
Content-Encoding: gzip
Age: 3170964
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 17 Feb 2020 22:55:27 GMT
Server: nginx
ETag: W/"5e4b19df-b7c7"
Content-Type: application/x-javascript
Via: 1.1 f66aaf2d9f6a8e65595a1e24d5f18bcd.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000, public
X-Amz-Cf-Pop: TXL52-C1
X-Amz-Cf-Id: HLOd95Dmlf4HdNIkbU3nOfD6nd8mGcglF0RjtCDNfYI2gOXBci42eA==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK /
srv-2020-03-25-15.pixel.parsely.com/plogger/ 43 B
229 B 470ms
117ms Image
image/gif 52.4.237.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-03-25-15.pixel.parsely.com/plogger/?rand=1585151599376&plid=94033813&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22parsely_uuid%22%3A%22daf46ca7-c62a-49bb-8afa-550bf474a3b3%22%2C%22parsely_site_uuid%22%3A%22daf46ca7-c62a-49bb-8afa-550bf474a3b3%22%7D&sid=1&surl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&sref=&sts=1585151599373&slts=0&title=Windows+code-execution+zeroday+is+under+active+exploit%2C+Microsoft+warns+%7C+Ars+Technica&date=Wed+Mar+25+2020+16%3A53%3A19+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&pvid=34824334&u=daf46ca7-c62a-49bb-8afa-550bf474a3b3
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.237.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-237-129.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK user Show response
4d.condenastdigital.com/ 67 B
428 B 144ms
144ms XHR
application/json 52.23.50.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/user?xid=cb5ae8de-162c-43b3-bf91-c813030ec079
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.23.50.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-23-50-9.compute-1.amazonaws.com
Software: /
Resource Hash: c7a1b7b76d4f4e882c74b9c90c8f4c866042956843002bb8a1e4c84fe161c3c3

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 15:53:19 GMT
content-encoding: gzip
transfer-encoding: chunked
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
Connection: keep-alive

GET
H/1.1 200
OK l Show response
mcdp-chidc2.outbrain.com/ 4 B
377 B 488ms
123ms XHR
application/json 50.31.142.31
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://mcdp-chidc2.outbrain.com/l?token=454590c213194b9c447fd8af456b4e87_6817_1585151599650&tm=1166&eT=0&tpcs=0&wRV=1050170&pVis=0&lsd=23097b62-d1f9-4a36-87c7-45aff3164815&eIdx=&cheq=0&ab=0&wl=0

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

50.31.142.31 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

chi.outbrain.com

Software

Resource Hash

c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 15:53:20 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Connection: close
X-TraceId: e87458a67df9a29b1c8af10d571a2631
Content-Length: 30

GET
H/1.1 200
OK Cookie set obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame 8E9F 0
0 19ms
18ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585151597628
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: recs_9889cb432df9afa2654983c28261e9ba=0B2055935695A2709007989A2002704744A2133537399A2723991248A2705036627ACD1; obuid=23097b62-d1f9-4a36-87c7-45aff3164815
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "938505833703786e7ccfce1fecf1cd66:1582216491.628225"
Last-Modified: Thu, 20 Feb 2020 16:34:45 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=604800
Date: Wed, 25 Mar 2020 15:53:19 GMT
Content-Length: 3518
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585151599~rv=47~id=fa5a55ed9625fc7cf77db36522eb5e04; path=/; Expires=Wed, 25 Mar 2020 15:53:19 GMT; Secure; SameSite=None

GET
H/1.1 200
OK eyJpdSI6IjViZDIyYTRmNmM5MzcyZjE5MzI0ZjI4MTM1YWQzZjUwYzI3MTkwOWJlOTc1MzNjYzJiODU5YjM3MmFhMDc1ZDAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 5 KB
6 KB 59ms
19ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjViZDIyYTRmNmM5MzcyZjE5MzI0ZjI4MTM1YWQzZjUwYzI3MTkwOWJlOTc1MzNjYzJiODU5YjM3MmFhMDc1ZDAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

c200042c1052143789767de2f9311ef48e628f75652a38049a69b4d638c48200

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Wed, 18 Mar 2020 11:11:51 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1871518
Connection: keep-alive
X-TraceId: be71395f8918cd95c6315213d8fca706
Timing-Allow-Origin: *
Content-Length: 5416

GET
H/1.1 200
OK eyJpdSI6IjhkYjdkNmY5NTRkZWZiYTk1MWQ2NmQwYmY4OTY0YWM1NTNjNTVkMDMyYjAwZWMxYWQxZTUwZmY5ODljNmY1YWQiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 10 KB
10 KB 62ms
21ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjhkYjdkNmY5NTRkZWZiYTk1MWQ2NmQwYmY4OTY0YWM1NTNjNTVkMDMyYjAwZWMxYWQxZTUwZmY5ODljNmY1YWQiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

57d38569b4cfbd8173852a2da74867fbb37937656e4785f07101acb29d51f334

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Fri, 13 Mar 2020 09:31:37 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1778822
Connection: keep-alive
X-TraceId: 5804b27aac69803a68e64893ed01c11c
Timing-Allow-Origin: *
Content-Length: 9932

GET
H/1.1 200
OK eyJpdSI6ImJjMTQ2MDFmZjc3OWE0ZDNjOTI5OGVlYWYwOGQ0ZWNmNjEyNWJlZDY2ZTc2NTcwMGZlYTE3ZDA2ZmU1Njg2ZGUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 14 KB
14 KB 80ms
22ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6ImJjMTQ2MDFmZjc3OWE0ZDNjOTI5OGVlYWYwOGQ0ZWNmNjEyNWJlZDY2ZTc2NTcwMGZlYTE3ZDA2ZmU1Njg2ZGUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

92f7b7ca663f4f9078e82b9c026a5234676fc2e4810acd286cc9689e96e34db5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Thu, 20 Feb 2020 13:52:11 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=186714
Connection: keep-alive
X-TraceId: 769a7d16d22d9378533fcadc94aa868a
Timing-Allow-Origin: *
Content-Length: 14238

GET
H/1.1 200
OK eyJpdSI6IjA2ZGU0NDYxM2JlNDE4OGMzMGY5Y2MxMmY3ZTc2Mzg5ZjljMzVlYjRmNmY3ZWUzNTJhYzIzYTc2MWVmZDdjNDMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 19 KB
20 KB 84ms
22ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjA2ZGU0NDYxM2JlNDE4OGMzMGY5Y2MxMmY3ZTc2Mzg5ZjljMzVlYjRmNmY3ZWUzNTJhYzIzYTc2MWVmZDdjNDMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

e2278458d4ed45932ff7813793b083ebae18e8bb206180821673d6384d54bf5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Fri, 28 Feb 2020 05:34:47 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=634529
Connection: keep-alive
X-TraceId: ba9dd5245fbdff3d77e91ba9daaa0d39
Timing-Allow-Origin: *
Content-Length: 19615

GET
H/1.1 200
OK eyJpdSI6IjQ3Yjc3MTJkYjgyMTdlMGQ4ODQyODc4YWU2MTA5YThiMTA4YzY0NWE4NTNmMTU5MGI5MDQzYjZhYzI2MGE4MDAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 4 KB
4 KB 102ms
21ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjQ3Yjc3MTJkYjgyMTdlMGQ4ODQyODc4YWU2MTA5YThiMTA4YzY0NWE4NTNmMTU5MGI5MDQzYjZhYzI2MGE4MDAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

d8b743a03a567d9929ef8410bcf067ddccea462906b6f3af1dbffc375860bdf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Mon, 23 Mar 2020 17:49:40 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2357466
Connection: keep-alive
X-TraceId: 22843fede0f95d5e34e11ac63417fefd
Timing-Allow-Origin: *
Content-Length: 3842

GET
H/1.1 200
OK eyJpdSI6IjI2NDMyMDQ0NDQyZDhjOTkyODg4NzJlODA4MDNmMTY4M2VhMWU2YzVmMGZiODE0MmFhMzI3MGM1OThhYjE3NDEiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 12 KB
13 KB 88ms
47ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjI2NDMyMDQ0NDQyZDhjOTkyODg4NzJlODA4MDNmMTY4M2VhMWU2YzVmMGZiODE0MmFhMzI3MGM1OThhYjE3NDEiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

5b2b369d337d4bf1de282f6745cee3a27a5da01fb7da415352aa1c450962699b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Mon, 02 Mar 2020 16:11:17 GMT
Date: Wed, 25 Mar 2020 15:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1799593
Connection: keep-alive
X-TraceId: 11378e9e0fc9320cedb2b74885cebfc7
Timing-Allow-Origin: *
Content-Length: 12542

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 488ms
121ms Other
image/gif 52.22.87.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.87.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-87-69.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 15:53:20 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 117ms
116ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A19.871Z&_t=pageview&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=8a96dc04-06b9-4983-91e9-3365353832bd&sID=f5f202fc-509c-494f-a66c-e10703784428&pID=5488aa4c-1f8b-42b8-9f1d-550ce01aa3f0&uDt=desktop&_o=ars-technica&_c=general&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:19 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 478ms
478ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2828614792540242&correlator=1836787515138081&output=ldjh&impl=fifs&adsid=NT&eid=21065763%2C21065202%2C21065392&vrg=2020032301&npa=1&guci=2.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Crail%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Drail%26ctx_slot_type%3Dsiderail%26ctx_slot_rn%3D0%26amznbid%3D15xfn5s%26amznp%3D3ai6m8%26amzniid%3DImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y%26amznsz%3D300x250%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dsiderail_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dattackers-exploit-windows-zeroday-that-can-execute-malicious-code%26cnt_tags%3Dexploits%252Cflaw%252Cmicrosoft-3%252Cvulnerabilities%252Cwindows%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C131103%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252C0lw01o%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cimc5qw%252Cfdf1wd%252Cf5u35n%252C65f9pd%252Ccymbhor-t09%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585151600&dt=1585151600776&dlt=1585151597441&idt=1284&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=370&adks=1483574547&ucis=3&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&dssz=46&icsg=35229469245440&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x250&ga_vid=1168255866.1585151598&ga_sid=1585151599&ga_hid=1228582819&fws=516&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

dd8c9abf2e84beb86d68533601a6bfe85881ff1d974e3354aa29937dcbb60ee3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2199
x-xss-protection: 0
google-lineitem-id: 4963601705
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138260492124
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 11 KB
5 KB 218ms
217ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2828614792540242&correlator=1836787515138081&output=ldjh&impl=fifs&adsid=NT&eid=21065763%2C21065202%2C21065392&vrg=2020032301&npa=1&guci=2.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Chero%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=728x90%7C970x250%7C9x1%7C10x1&prev_scp=pos%3Dhero%26ctx_slot_type%3Dpost_nav%26ctx_slot_rn%3D0%26amznbid%3D2%26amznp%3D2%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dpost_nav_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dattackers-exploit-windows-zeroday-that-can-execute-malicious-code%26cnt_tags%3Dexploits%252Cflaw%252Cmicrosoft-3%252Cvulnerabilities%252Cwindows%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C131103%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252C0lw01o%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cimc5qw%252Cfdf1wd%252Cf5u35n%252C65f9pd%252Ccymbhor-t09%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585151600&dt=1585151600782&dlt=1585151597441&idt=1284&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=80&adks=2385402828&ucis=4&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&dssz=46&icsg=35229469245440&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x90&msz=1585x90&ga_vid=1168255866.1585151598&ga_sid=1585151599&ga_hid=1228582819&fws=4&ohw=1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

b23e846d50576bc1d79878f8ac9e7a12ed457a8afd3b9b3cf7cae810831c6591

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 15:53:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5419
x-xss-protection: 0
google-lineitem-id: 5199899035
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138291741869
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 82FB 0
0 33ms
32ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUN74VluPANDa1irYIIE3M-1GdyDqGMN567R7HrhxbINtYhi86yBc-J3ZX8vUV1wE4DLkcouTwhm-keJJiXPxbcxG8kBacOggB5lNjAuI4VIBsbvAgP1KSuHgPab1TXPQylJ1Y50FeqrrgkurwB_-UNcuOdaZ_lIFolzdlp1jdTBNVhP_kOjkVowDJs6dnUR950KG44K99fLBft_It4oZwRipT0mjlTGyRw8SpMdV6z5teJ9PZQ_FH0ltG3ErT6A-hnn5iaxqfApfaYenz_EYPc-9IH8o7W5LykRhofLWtiBhwHg&sai=AMfl-YTPYqQXAAMp9I3_OyRqDXmttoC7tsEDs31b6tBmCDSh4hlz_3JzFG_qzG5_4ZEaur5wYlOZw27EV9jX9DhFMxltHW_1etVV65jtL3Vj&sig=Cg0ArKJSzJU-Pmy7za8PEAE&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 15:53:21 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20200319/r20110914/client/ Frame 82FB 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200319/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7ec8f4f61d81af95253c861bd5164cd8ac2eceac931f6385651717389e614f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 14:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 1228
x-xss-protection: 0
server: cafe
etag: 6354087966754203456
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Apr 2020 14:10:31 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 82FB 74 KB
28 KB 58ms
57ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28201
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame 82FB 305 KB
102 KB 21ms
20ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:26:37 GMT
server: AmazonS3
x-amz-request-id: E900255BB404E6B3
etag: "2c762a4ad391b25a73e9e0b5e560bfbf"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=48981
accept-ranges: bytes
content-length: 104203
x-amz-id-2: fTFMlX4oxgS0IRYo7c44ll02v0Hl8SxbpBFjLogMv8UmrBC2cLIp8SU18/NX1dpttUO4UCoVkaI=

GET
H2 200 3620775402031980276
tpc.googlesyndication.com/simgad/ Frame 82FB 523 KB
524 KB 10ms
10ms Image
image/gif 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3620775402031980276

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcdbb836fdddf19a49a6161d6901356e4b64240a5328493c3458a1d99aeee487

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 10 Mar 2020 15:38:48 GMT
x-content-type-options: nosniff
age: 1296873
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 535949
x-xss-protection: 0
last-modified: Wed, 23 Oct 2019 14:26:35 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Mar 2021 15:38:48 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
27 KB 59ms
59ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27941
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 29ms
29ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=post_nav_0&zMoatRendered=3&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=3&zMoatSafetyTargetingSet=3&zMoatEmptySlot=2&zMoatNadoDataLoadTime=262&zMoatAllDataLoadTime=262&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&if=262&na=554722007&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:21 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 116ms
115ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A21.015Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=9e7c7342-c2e3-4434-963a-ef9a3bda3fea&uNw=1&uUq=1&pID=148bfd95-bde8-48a6-81bc-8f4662b0176b&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2615518737%2C%22creativeId%22%3A138291741869%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5199899035%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22728x90%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151601015%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:21 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame 82FB 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d447a49fa9eee2c16db401b1a6c62e2bd605bf52e74e2fb066f1a819a87753e0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8C3E 0
0 30ms
30ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLlf4Tp7aEl51-IEX7AaiYwGSnCZ0sALJ_L4TUZuiz_YyEfykL5viJApib41aek-NdkSEJEf6tB25LTrOWOh5K9wAmyZG51caDK5ztv_HuUMS_4UxVX_WjrgmxhCKCK5fTxdvjOa38Jf6yZzqaxyAYHOm_fay274GkAWanhoxe7iZ5hAvba4eFhtNTWOVqDdClb1KRd-MDGxaOUGqI_NGNp25StDViVBJM-cGfKy9gd4-jfgyEs_s9Qnf9qXFJpCuoAmDprQLNybbAk_1xrz1TA1DrcdK6bF733NSrmB8Jhx3RlUkvkA&sai=AMfl-YQ0tpCDh-Ox3XDrW5NnZToxA13u4Dhcn56LR2PxA3saZevrsepDLbs4D6EYjgAq8QCwObzoTfmwiEpck7t-4uQ978jj4QZAi5kssWWETQ&sig=Cg0ArKJSzC6uHuCfd8-LEAE&urlfix=1&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 15:53:21 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8C3E 74 KB
28 KB 53ms
53ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28201
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame 8C3E 305 KB
102 KB 18ms
18ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:26:37 GMT
server: AmazonS3
x-amz-request-id: E900255BB404E6B3
etag: "2c762a4ad391b25a73e9e0b5e560bfbf"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=48981
accept-ranges: bytes
content-length: 104203
x-amz-id-2: fTFMlX4oxgS0IRYo7c44ll02v0Hl8SxbpBFjLogMv8UmrBC2cLIp8SU18/NX1dpttUO4UCoVkaI=

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 22ms
22ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585151597753&de=23486295530&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=siderail_0&zMoatRendered=4&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=4&zMoatSafetyTargetingSet=4&zMoatEmptySlot=2&zMoatNadoDataLoadTime=262&zMoatAllDataLoadTime=262&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&ac=1&bq=11&f=0&zn=0&if=262&na=1818282803&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:21 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:21 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 115ms
115ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A21.266Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=dddf864d-6de1-4e88-a130-c089be9b8594&uNw=1&uUq=1&pID=79e946a5-a549-4a54-9e73-46c9174bc64e&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A1477180135%2C%22campaignId%22%3A2494018986%2C%22creativeId%22%3A138260492124%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4963601705%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x250%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151601266%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22amznbid%22%3A%5B%2215xfn5s%22%5D%2C%22amznp%22%3A%5B%223ai6m8%22%5D%2C%22amzniid%22%3A%5B%22ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y%22%5D%2C%22amznsz%22%3A%5B%22300x250%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:21 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame 8C3E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ff41f2c37c522b1922dbdf343e6addf024fd52290ee1248333689d9683395406

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK admi
aax-eu.amazon-adsystem.com/e/dtb/ Frame 065A 0
0 44ms
44ms Document
text/html 52.94.216.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-eu.amazon-adsystem.com/e/dtb/admi?b=ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y&rnd=2382025889441585151601264&pp=15xfn5s&p=3ai6m8&crid=2676:36208491
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.216.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash

Request headers

Host: aax-eu.amazon-adsystem.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

Server: Server
Date: Wed, 25 Mar 2020 15:53:21 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 1896
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip

GET
H2 200 csm_others.js Show response
c.amazon-adsystem.com/bao-csm/direct/ Frame 8C3E 43 KB
15 KB 38ms
38ms Script
application/javascript 143.204.180.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/direct/csm_others.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.180.160 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-180-160.lhr50.r.cloudfront.net
Software: Server /
Resource Hash: cde97b4d863db88fb8d427ca01d2b30ce978eef755ea178a93a71d2494caeb78

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 08:28:36 GMT
content-encoding: gzip
server: Server
age: 26686
etag: 5c063c22f85e7ef90d05f967ea3cab21
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: LHR50-C1
accept-ranges: bytes
x-amz-cf-id: 8sMt_da7Q3fB6R7o3whgxsxnpEEQBKOTTCeW9h7z8UKP3t6c8VatHg==
via: 1.1 77b70daab6366766b49607e666ee5cb6.cloudfront.net (CloudFront)

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ 96 KB
30 KB 63ms
29ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: d8435911753d7e931e1dda44b3ec12ce5158d6389131eadb584f0097a809c901

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
content-encoding: gzip
last-modified: Tue, 17 Mar 2020 08:42:53 GMT
server: nginx
access-control-allow-origin: *
etag: W/"5e708d8d-18138"
content-type: text/javascript
status: 200
cache-control: max-age=86400, public
timing-allow-origin: *
expires: Thu, 26 Mar 2020 15:53:21 GMT

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 41ms
40ms XHR
application/json 52.50.175.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183973
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.175.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-175-184.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 9c61c9dd04e0f163b6f41a3139abc3dbc8162ef89455d518c302c8a148332f37

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 25 Mar 2020 15:53:21 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Fri, 24 Apr 2020 15:53:21 GMT

GET
H2 404 idsv2 Show response
mid.rkdms.com/ 0
0 322ms
23ms XHR
application/xml 52.222.158.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CONDENAST
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.158.161 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-158-161.fra53.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

GET
H/1.1 200
OK %7B%22adCsm%22:[%7B%22vfrd%22:8,%22dbg%22:%22nomime%22,%22isP%22:0,%22inf%22:%22%22%7D,%7B%22pt%22:%22nvd%22,%22lw%22:0,%22hg%22:4503599627370496,%22en%22:%22l%22,%22plt%22:%22Linux%20x86_64%22%7D,...
aax.amazon-adsystem.com/x/px/ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y/ Frame 8C3E 43 B
245 B 1407ms
45ms Image
image/gif 52.94.216.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax.amazon-adsystem.com/x/px/ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y/%7B%22adCsm%22:[%7B%22vfrd%22:8,%22dbg%22:%22nomime%22,%22isP%22:0,%22inf%22:%22%22%7D,%7B%22pt%22:%22nvd%22,%22lw%22:0,%22hg%22:4503599627370496,%22en%22:%22l%22,%22plt%22:%22Linux%20x86_64%22%7D,%7B%22tld%22:%22arstechnica.com%22%7D,%7B%22ns%22:1585151601260,%22st%22:%2275.98%22,%22re%22:%22114.80%22,%22ldTot%22:%2238.82%22%7D],%22pixelId%22:%22snw598szbg%22,%22ts%22:1585151601396,%22ver%22:%22d-1.19%22%7D?cb=8356204
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.216.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:22 GMT
Server: Server
Vary: User-Agent
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 117ms
117ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A22.267Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=dddf864d-6de1-4e88-a130-c089be9b8594&sID=f3e4002a-b491-4f23-9676-4676f19f4e8f&pID=79e946a5-a549-4a54-9e73-46c9174bc64e&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2615518737%2C%22creativeId%22%3A138291741869%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Atrue%2C%22isFirstImpressionViewable%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Atrue%2C%22isFirstMoneyImpressionViewable%22%3Atrue%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5199899035%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22728x90%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151601015%2C%22viewable%22%3A1585151602267%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1585151601128%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:22 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 82FB 42 B
216 B 31ms
29ms Image
image/gif 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsucmztgAwxkWVUmy8ta-B0iQIuTBp_d9T3SHbqKraM7ZvBlnFEXEjRn87RSGAEI1HmSXmpFoOdSQ0s9re-0yh6iTWxKrBCmZHp8LnnW40c&sig=Cg0ArKJSzMJDVGIryazJEAE&adk=2385402828&tt=-1&bs=1585%2C1200&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&p=80,429,170,1157&mcvt=1016&rs=0&ht=0&tfs=209&tls=1225&mc=1&lte=0&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585151601012&dlt&rpt=137&isd=0&msd=0&ext&xdi=0&ps=1585%2C4074&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-13-4-12-12-0-0-0&tvt=1222&is=728%2C90&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&r=v&id=osdim&vs=4&uc=13&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=728x90&itpl=3&v=20200323

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:22 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 118ms
117ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A22.390Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=dddf864d-6de1-4e88-a130-c089be9b8594&sID=f3e4002a-b491-4f23-9676-4676f19f4e8f&pID=79e946a5-a549-4a54-9e73-46c9174bc64e&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A1477180135%2C%22campaignId%22%3A2494018986%2C%22creativeId%22%3A138260492124%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpressionViewable%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpressionViewable%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4963601705%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x250%22%2C%22slug%22%3A%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=%7B%22footerStart%22%3A1585151597598%2C%22headerStart%22%3A1585151597582%2C%22navigationStart%22%3A1585151596849%2C%22injected%22%3A1585151601266%2C%22viewable%22%3A1585151602389%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22amznbid%22%3A%5B%2215xfn5s%22%5D%2C%22amznp%22%3A%5B%223ai6m8%22%5D%2C%22amzniid%22%3A%5B%22ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y%22%5D%2C%22amznsz%22%3A%5B%22300x250%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22attackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%5D%2C%22cnt_tags%22%3A%5B%22exploits%22%2C%22flaw%22%2C%22microsoft-3%22%2C%22vulnerabilities%22%2C%22windows%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22131103%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%220lw01o%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22imc5qw%22%2C%22fdf1wd%22%2C%22f5u35n%22%2C%2265f9pd%22%2C%22cymbhor-t09%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:22 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 8C3E 42 B
110 B 32ms
32ms Image
image/gif 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssH3tBEvl7xLvGmorVU1_GJZQMHtTOZUOQAhHJWWgVt0yukd4hh5YoH0DZ1pEzlZVUNK9GY40Rnz_P6KMUfbUQ5l7UqSHbEvImscY2GvGw&sig=Cg0ArKJSzMXAxlUchLOaEAE&adk=1483574547&tt=-1&bs=1585%2C1200&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&p=370,1063,620,1363&mcvt=1008&rs=0&ht=0&tfs=103&tls=1111&mc=1&lte=0&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585151601265&dlt&rpt=73&isd=0&msd=0&ext&xdi=0&ps=1585%2C4074&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-2-11-11-0-0-0&tvt=1110&is=300%2C250&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&r=v&id=osdim&vs=4&uc=12&upc=0&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200323

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:22 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 120ms
120ms Other
image/gif 52.22.87.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.87.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-87-69.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 15:53:23 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK %7B%22adCsm%22:[%7B%22lteu%22:%220.06%22,%22ltut%22:%220.02%22,%22ltpq%22:%220.03%22,%22lths%22:%220.07%22,%22ltpm%22:%220.13%22,%22ltfm%22:%2216.99%22,%22ltdm%22:%220.10%22,%22ltdb%22:%220.01%22,%...
aax.amazon-adsystem.com/x/px/ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y/ Frame 8C3E 43 B
245 B 45ms
45ms Image
image/gif 52.94.216.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax.amazon-adsystem.com/x/px/ImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y/%7B%22adCsm%22:[%7B%22lteu%22:%220.06%22,%22ltut%22:%220.02%22,%22ltpq%22:%220.03%22,%22lths%22:%220.07%22,%22ltpm%22:%220.13%22,%22ltfm%22:%2216.99%22,%22ltdm%22:%220.10%22,%22ltdb%22:%220.01%22,%22csmTot%22:%220.78%22%7D],%22pixelId%22:%22snw598szbg%22,%22ts%22:1585151603880,%22ver%22:%22d-1.19%22%7D?cb=1297183
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.216.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:23 GMT
Server: Server
Vary: User-Agent
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 111ms
111ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pID=79e946a5-a549-4a54-9e73-46c9174bc64e&sID=f3e4002a-b491-4f23-9676-4676f19f4e8f&uId=dddf864d-6de1-4e88-a130-c089be9b8594&xid=&_ts=2020-03-25T15%3A53%3A25.169Z&_c=error&_t=Interlude%20Insertion%20Error&dim1=%7B%22interludeFailure%22%3A%22unsupported%20template%22%2C%22pageTemplate%22%3A%22article%7Creport%22%2C%22url%22%3A%22information-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%22%7D&dim3=Availability%3A%20unsupported%20template
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:25 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 112ms
112ms Image
image/gif 34.226.109.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T15%3A53%3A25.376Z&_t=timespent&cBr=Ars%20Technica&cKe=exploits%7Cflaw%7Cmicrosoft%7Cvulnerabilities%7CWindows&cCh=information%20technology&cTi=Windows%20code-execution%20zeroday%20is%20under%20active%20exploit%2C%20Microsoft%20warns&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.47727889746646635%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951%2C%200.3389960975200951&cEnt=windows%2C%20microsoft%2C%20page%20layout%2C%20zeroday%2C%20remote%20code-execution%2C%20adobe%20type%201%2C%20adobe%20system%2C%20dan%20goodin%2C%20hacker%2C%20adobe%20type%20manager%2C%20utc%2C%20postscript%2C%20malicious%20payload%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20media%20group%2C%20ar%2C%20rename%20atmfd.dll&cEnw=1%2C%200.8315457476124544%2C%200.6427029821559366%2C%200.5023301028670565%2C%200.4796852697653377%2C%200.4716311197846365%2C%200.4453950850636448%2C%200.3990321160576756%2C%200.3937633118795625%2C%200.38793267905948103%2C%200.36993762162244276%2C%200.3671049223370393%2C%200.3518169887813935%2C%200.32435051078562427%2C%200.290503240766117%2C%200.24531746048684747%2C%200.23743691924222773%2C%200.23722376840188938%2C%200.23485826353871672%2C%200.23333092453202628&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=725&cId=1662596&cPd=2020-03-23T19%3A40%3A00.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=dddf864d-6de1-4e88-a130-c089be9b8594&sID=f3e4002a-b491-4f23-9676-4676f19f4e8f&pID=79e946a5-a549-4a54-9e73-46c9174bc64e&uDt=desktop&dim1=v1.0.25_iframe_query&_o=ars-technica&_c=general&xID=cb5ae8de-162c-43b3-bf91-c813030ec079&_v=5000&environment=prod&origin=ars-technica&cKh=windows%2Cmicrosoft%2Cvulnerability%2Cattacker%2Cpage%20layout
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.109.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-109-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 15:53:25 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 204 identity Show response
api.rlcdn.com/api/ 0
203 B 70ms
29ms XHR
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&ct=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 25 Mar 2020 15:53:29 GMT
via: 1.1 google
alt-svc: clear
status: 204
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
access-control-allow-headers: Cookie, Accept, Origin, Authorization, Content-Type

GET
H2

302

ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

237ms
136ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

515ms
414ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
2 KB 275ms
199ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=15&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1537754&kw=rp.fastlane&tk_flint=index&rand=0.12359990145670441&gdpr=1&gdpr_consent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&alt_size_ids=10
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 8b35ff266e397b96b73e7452d2a5418c11f5372184b794d6f6dac44e4121dcdf

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:29 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=61
Content-Length: 1848
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
478 B 170ms
128ms XHR
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A32883313%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2233%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2231%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22dfcef67f-0c74-40c1-985d-4e6d6ed12c1a%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222020-03-25T15%3A53%3A21%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1dccec8257fd94b901a9a66fe40b203481ceae96f000a496046fd02d1e6a699c

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 86
Expires: Wed, 25 Mar 2020 15:53:29 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 249 B
376 B 153ms
56ms XHR
application/json 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=87&profileId=154&cb=97641437556
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: 49127a2bd3f9d892ed4d924759e75738dce8580911f372d05a4f7907852d28c5

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 25 Mar 2020 15:53:29 GMT
content-encoding: gzip
server: Finatra
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 169

GET
H2 200 placementbid.json Show response
an.facebook.com/v2/ 96 B
1 KB 136ms
121ms XHR
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://an.facebook.com/v2/placementbid.json?sdk=5.5.web&placementids%5B%5D=2038188213062675_2473096466238512&adformats%5B%5D=300x250&cachebuster=CK7rpsepJACoUt6XVar49OwDBFaymS5DBliqrFvxBTqLIwJeXvMJ5hCD&platform=2061185240785516&adapterver=2.1.0

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

12ed8cb3d2032fe909c60cf99861678c3a5ea4ab13fce07e02d8a643d5194335

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
x-fb-an-errors
access-control-expose-headers: X-FB-AN-Request-ID, X-FB-AN-Errors, X-FB-AN-Bid-Count
x-fb-an-request-id: 8826328244610434498
status: 200
alt-svc: h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: 1M2ADQwFrXk+Y+ez9jJymZLzvgg74Jq5imjdDA+U70d5XP6Ja1jE+epldsS7D9kT/8rBxHEk6gv9qCAgxdgB8w==
x-frame-options: DENY
date: Wed, 25 Mar 2020 15:53:29 GMT, Wed, 25 Mar 2020 15:53:29 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: https://arstechnica.com
x-fb-an-bid-count: 0
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
478 B 295ms
134ms XHR
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A36209524%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%227%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%228%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22dfcef67f-0c74-40c1-985d-4e6d6ed12c1a%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222020-03-25T15%3A53%3A21%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 07116da6feb90f7d607e6b239f8a72792ba809dc2cc679cea6c50eb290dcbd5f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 86
Expires: Wed, 25 Mar 2020 15:53:29 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
145 B 143ms
53ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=87&profileId=154&cb=98556997191
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

status: 204
date: Wed, 25 Mar 2020 15:53:28 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://arstechnica.com
timing-allow-origin: *
vary: Origin

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
2 KB 418ms
157ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=2&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1537752&kw=rp.fastlane&tk_flint=index&rand=0.07195778153482957&gdpr=1&gdpr_consent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&alt_size_ids=57
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 4d9f958bed0c78f6f884f109f212779e451675dbcbd67f383abdb6d850142785

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:29 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=254
Content-Length: 1851
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

213ms
132ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

212ms
132ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=...

0
-1 B

133ms
132ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=...

0
-1 B

133ms
132ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=...

0
-1 B

129ms
128ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ 2 KB
2 KB 210ms
208ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1Ac5a02744-6eb0-11ea-b7af-122675b00be4;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._k881YzQf;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a5514acb09d88f85f7960ccce359b8e57bbafebaa32b1810b9ac620024772979

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ 2 KB
2 KB 219ms
218ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1Ac5a0369e-6eb0-11ea-826f-121160e138ec;cfp=1;rndc=1585151608;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._l1NxyZN6;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 080ed19ae8951da40005d794c16c0c9896aeb9d56872fe208207dceb7179cf0c

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ 2 KB
2 KB 211ms
211ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1Ac5a0391e-6eb0-11ea-9a97-12e614795296;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609442;callback=window.headertag.AolHtb.adResponseCallbacks._3QntmPwz;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 80524e5e72f57c1c89bd92ad8e3ee2dbd428419ff493aeb814edb17166e96dab

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1770
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ 2 KB
2 KB 202ms
201ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585151609;cmd=bid;cors=yes;v=2;misc=1585151609422;callback=window.headertag.AolHtb.adResponseCallbacks._nxVCoDZM;gdpr=1;euconsent=BOw0vBtOw0vBtAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a94eb62779f011f360ef902b0d15554867ff16a86aa0e3fcdf257177fd8ceb87

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:30 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
339 B 75ms
33ms XHR
text/plain 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:30 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Wed, 25 Mar 2020 15:53:30 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
339 B 26ms
26ms XHR
text/plain 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 15:53:30 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Wed, 25 Mar 2020 15:53:30 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 18ms
18ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=6&kq=1&lo=3&uk=null&pk=1&wk=1&rk=1&tk=1&ak=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fe%2Fdtb%2Fadmi%3Fb%3DImFUSKtIzldVY1ossCm8XrwAAAFxEmXiVwMAAAvbAT0fe4Y%26rnd%3D2382025889441585151601264%26pp%3D15xfn5s%26p%3D3ai6m8%26crid%3D2676%3A36208491&i=CONDECW3&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjhBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&id=1&cm=0&f=0&j=&t=1585151601330&de=996890695266&cu=1585151601330&m=11457&ar=b63606d9a9-clean&iw=70485c0&cb=0&ym=0&ll=2&lm=0&ln=1&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4074&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A771%3A771%3A0%3A1131&as=1&ag=10000&an=5372&gi=1&gf=10000&gg=5372&ix=10000&ic=10000&ez=1&ck=1150&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10000&bx=5372&ci=1150&jz=1004&dj=1&aa=1&ad=9900&cn=5272&gn=1&gk=9900&gl=5272&ik=9900&co=1050&cp=1004&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9854&cd=5223&ah=9854&am=5223&rf=0&re=0&wb=2&cl=0&at=0&d=1477180135%3A2494018986%3A4963601705%3A138260492124&zMoatPlacID=21711241635&bo=21698048816&bp=21711241635&bd=Undefined&zMoatPT=article&zMoatST=siderail&zMoatLL=Lazy%20Load%20Not%20Defined&zMoatRFSH=Refresh%20Not%20Defined&zMoatNoRFSH=true&dfp=0%2C1&la=21711241635&zMoatAltSL=bo%3AzMoatAdUnit2%3AzMoatAdUnit3&gw=condenastdfp9588492144&zMoatOrigSlicer1=21698048816&zMoatOrigSlicer2=21711241635&zMoatPS=siderail_0&zMoatCNS=6.32.6&zMoatSZ=300x250&zMoatKWPos=Undefined&zMoatPlat=wordpress&zMoatMMV_MAX=na&dfpSlotId=siderail_0&zMoatCURL=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&zMoatDev=Desktop&hv=DEMANDMEDIAHEADER&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=siderail_0&iq=na&tt=na&tc=0&fs=177454&na=595966159&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:32 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
6 KB 30ms
17ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

678cb55f625d57394ca1dbde7e23ae5485a09b135f28dc33926c249ead338f3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 15:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5187
x-xss-protection: 0

POST
H2 200 collect
www.google-analytics.com/r/ 35 B
102 B 14ms
13ms Other
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/r/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: https://arstechnica.com
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 15:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 25 Mar 2020 15:53:33 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 95F3 0
0 7ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 25 Mar 2020 15:51:32 GMT
expires: Thu, 25 Mar 2021 15:51:32 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 121
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
60 B 32ms
28ms Image
image/gif 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032301&jk=2828614792540242&bg=!zM-lz9dYGYBV9n_URd4CAAAAYFIAAAAMmQFbmO8bZylQ1TtvMykCOJu5BdRkKKsMMteThrx2r3r_NDZP_L9-ucSWK0GzkzzM-1vlMPaZ7xxgAEjCIYVYDv97ghN9Ul9x8fXjfGb7puC5KHidjuSwkxzb_M5DFGuK3zMHE3NfoeHrNYmP9ZLAqte4X5QlfFyjSaQ6SlvPkV6jrhTaBoKacHGkAE-rWL_qpE-6iB07iddgZLhidr7uOy-X3ccM43BERq9trD65WQAccG42V8i-7H7UcXSTldGBYLMTvfqmxthZNTAlxDxx8z8NISsL4RkglQuLvHBvb-94unEzdxAaGpCvlvaq5j373ZFgPWDesHsd4ADtxsM9h82e0I6kYYD0dyzmqj2YygA9S8e-2cCnyLk_tJMggwVcXlY_BAD48iRq4qwyx9K-B5eom1KJNbbB3mFbU91x3GY2YGvs4YKkPnsVNDJvgK_yX7ZpLUCTFJZ2shfbjeE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:33 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 23ms
22ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=6&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F3620775402031980276&i=CONDECW3&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjhBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code%2F&id=1&cm=0&f=0&j=&t=1585151601101&de=937695774462&cu=1585151601101&m=15073&ar=b63606d9a9-clean&iw=70485c0&cb=0&ym=0&ll=2&lm=0&ln=1&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4074&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A771%3A771%3A0%3A1131&as=1&ag=15061&an=10040&gi=1&gf=15061&gg=10040&ix=15061&ic=15061&ez=1&ck=1197&kw=1000&aj=1&pg=100&pf=100&ib=0&cc=1&bw=15061&bx=10040&ci=1197&jz=1000&dj=1&aa=1&ad=14963&cn=9942&gn=1&gk=14963&gl=9942&ik=14963&co=1099&cp=1000&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=14864&cd=9843&ah=14864&am=9843&rf=0&re=1&ft=4829&fv=4829&fw=905&wb=2&cl=0&at=0&d=4552798968%3A2615518737%3A5199899035%3A138291741869&zMoatPlacID=21711241029&bo=21698048816&bp=21711241029&bd=Undefined&zMoatPT=article&zMoatST=post_nav&zMoatLL=Lazy%20Load%20Not%20Defined&zMoatRFSH=Refresh%20Not%20Defined&zMoatNoRFSH=true&dfp=0%2C1&la=21711241029&zMoatAltSL=bo%3AzMoatAdUnit2%3AzMoatAdUnit3&gw=condenastdfp9588492144&zMoatOrigSlicer1=21698048816&zMoatOrigSlicer2=21711241029&zMoatPS=post_nav_0&zMoatCNS=6.32.6&zMoatSZ=728x90&zMoatKWPos=Undefined&zMoatPlat=wordpress&zMoatMMV_MAX=na&dfpSlotId=post_nav_0&zMoatCURL=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fattackers-exploit-windows-zeroday-that-can-execute-malicious-code&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=post_nav_0&iq=na&tt=na&tc=0&fs=177454&na=1344235044&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 15:53:36 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 15:53:36 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 121ms
120ms Other
image/gif 52.22.87.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.87.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-87-69.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/attackers-exploit-windows-zeroday-that-can-execute-malicious-code/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 15:53:38 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.cnevids.com
URL: https://api.cnevids.com/v1/video_groups?filters={%22channel_key%22:%22arstechnica%22}&pagesize=20&endpoint=oo.arstechnica

Verdicts & Comments Add Verdict or Comment

141 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.arstechnica.com/	1970-01-19 08:19:11	Name: _gat_UA-31997-1 Value: 1
.arstechnica.com/	1970-01-19 08:20:38	Name: _gid Value: GA1.2.602429018.1585151613
.arstechnica.com/	1970-01-20 01:50:23	Name: _ga Value: GA1.2.1168255866.1585151598

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://static.criteo.net/js/ld/publishertag.js(Line 1) Message: %cPubTag color: #fff; background: #ff8f1c; display: inline-block; padding: 1px 4px; border-radius: 3px; ERROR: Error onError: TypeError: Cannot read property 'getItem' of null
console-api	log	URL: https://static.criteo.net/js/ld/publishertag.js(Line 1) Message: %cPubTag color: #fff; background: #ff8f1c; display: inline-block; padding: 1px 4px; border-radius: 3px; ERROR: Error onSuccess: TypeError: Cannot read property 'getItem' of null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4d.condenastdigital.com
aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
adserver-us.adtech.advertising.com
adservice.google.ch
adservice.google.com
ampcid.google.com
ampcid.google.de
an.facebook.com
api.cnevids.com
api.rlcdn.com
arstechnica.com
as-sec.casalemedia.com
bidder.criteo.com
c.amazon-adsystem.com
capture.condenastdigital.com
cdn.arstechnica.net
cdn.cookielaw.org
cdn.mediavoice.com
d1z2jf7jlzjs58.cloudfront.net
embed.actionbutton.co
fastlane.rubiconproject.com
geolocation.1trust.app
geolocation.onetrust.com
images.outbrainimg.com
infinityid.condenastdigital.com
js-sec.indexww.com
log.outbrainimg.com
match.adsrvr.org
mb.moatads.com
mcdp-chidc2.outbrain.com
mid.rkdms.com
odb.outbrain.com
p.skimresources.com
pagead2.googlesyndication.com
pixel.condenastdigital.com
player.cnevids.com
plugin.mediavoice.com
polarcdn-terrax.com
px.moatads.com
r.skimresources.com
s.skimresources.com
securepubads.g.doubleclick.net
segment-data.zqtk.net
srv-2020-03-25-15.config.parsely.com
srv-2020-03-25-15.pixel.parsely.com
static.criteo.net
stats.g.doubleclick.net
t.skimresources.com
tcheck.outbrainimg.com
tpc.googlesyndication.com
widgets.outbrain.com
wren.condenastdigital.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
z.moatads.com
api.cnevids.com
143.204.178.33
143.204.180.160
151.101.12.239
151.101.14.2
151.139.128.10
152.195.132.202
152.199.21.89
172.217.18.162
172.217.22.2
178.250.2.152
205.234.175.175
2606:4700:10::6814:b844
2606:4700::6811:4032
2606:4700::6812:db5d
2606:4700::6813:da83
2a00:1450:4001:806::2004
2a00:1450:4001:817::2002
2a00:1450:4001:817::200e
2a00:1450:4001:81b::2001
2a00:1450:4001:81b::200e
2a00:1450:4001:81d::2002
2a00:1450:4001:81d::2008
2a00:1450:4001:81d::200e
2a00:1450:4001:81e::2003
2a00:1450:400c:c00::9d
2a02:2638::3
2a03:2880:f01c:800e:face:b00c:0:2
3.20.147.38
34.226.109.227
35.190.59.101
35.201.67.47
35.244.174.68
50.31.142.31
52.19.1.241
52.22.87.69
52.222.158.161
52.23.50.9
52.4.237.129
52.50.175.184
52.94.216.48
54.152.112.230
63.35.59.66
64.202.112.127
69.173.144.140
95.101.185.159
95.101.185.246
95.101.185.51
95.101.186.38
99.84.155.90
99.84.156.8
00bd8c0d8620137ed2914b1958e62e894392f208c2f989e158565d9bb508e2fb
015045182758a421636084e2a2e43027e6ba1dd7005a2ec231b08d63c72d0fd7
0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c
02a9db289d960e3196e2269632ee772bbcb51333e9ab3503105ae7f3b1665062
030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06
032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3
039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05a2975ca40e7d714018e9704c2d82812a8735f335f78a5f8d274203bc2976da
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
07116da6feb90f7d607e6b239f8a72792ba809dc2cc679cea6c50eb290dcbd5f
080ed19ae8951da40005d794c16c0c9896aeb9d56872fe208207dceb7179cf0c
08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e
0df18872a7d32620388cdc4df1e18acaa761a157830bbf8e258599352fa933fb
0eb438ad4233f9cdadd2cf6e5e3544a29b1e693a03f45b0b9fa25e70f2675917
10c75f7c6402ea3c15ba35494f299a73e62877fca5786e50f18983243fa16873
1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83
12ed8cb3d2032fe909c60cf99861678c3a5ea4ab13fce07e02d8a643d5194335
17cfd03c7324bff29a75eed9529fb31764b922489e32030d4acabea1cc5a216f
1c89250469c4a6df401abf15a6bafed900638d24b7e497b9327124a59b80c0ed
1dccec8257fd94b901a9a66fe40b203481ceae96f000a496046fd02d1e6a699c
1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378
2bd6c30a523ce8b33d96dc79b1d759b5d5634740ae76aa6557e2d3741082e067
2f17ab3ac118eeddb8ac29b08b41a35c0a5f6cdb4a94097c69a36569c5e4d87e
351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101
49127a2bd3f9d892ed4d924759e75738dce8580911f372d05a4f7907852d28c5
49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39
49e94b0178df842a0dd066aad529f61d2bf0baf48a21430d86e726d402e1019c
4c849d13455fdf6ce1e23a0b84be7e6e72fdb3691c77cf949368d6e86f6eb955
4d9f958bed0c78f6f884f109f212779e451675dbcbd67f383abdb6d850142785
4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128
4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8
50ef3043544193fed57957cde3087cb24a4af2a605c37a6ddc4c11105ac7bbe0
5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b
54b9054fe0e58b7312d1b6ce1e820111b5bd0d6dd1f40a9d90c08d37a039ce37
55953987d8104311838ce0414adb751e86b32a69a9cbb441381ef67f1c4bbbb2
57d38569b4cfbd8173852a2da74867fbb37937656e4785f07101acb29d51f334
59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282
5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e
5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c
5ad2dd79dd70a3e9c03fcb2644b3dec3852424e0c5010a9054012304efe35b82
5b2b369d337d4bf1de282f6745cee3a27a5da01fb7da415352aa1c450962699b
5ca7d09c7b5f99182df6f62007d187311d760eea88843a69e9c03320804084ec
5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235
678cb55f625d57394ca1dbde7e23ae5485a09b135f28dc33926c249ead338f3a
6971adb7fc147ab4028012f8c0afa86bfad4101212c5881d1aab7c2fa6977b39
6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74
6f01f7dcdca22c184910f18ce17a1947c69fd34b46106a8b8437a5ae092f2a6e
6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a
72ff898f6d799030f097fb900d4a78a7ab005254a02e8f76f0455c1cfcc43497
759cbd9881e14214af52dfb585ccf70ea59037598b67cc9cf6df7d3fea7abfd0
78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207
80524e5e72f57c1c89bd92ad8e3ee2dbd428419ff493aeb814edb17166e96dab
807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8379daabd87751a7da8f1ed0c4b558d62f7d19a01b72a7f50153c1ec95f4ac9a
859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f
86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a
8b35ff266e397b96b73e7452d2a5418c11f5372184b794d6f6dac44e4121dcdf
8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92f7b7ca663f4f9078e82b9c026a5234676fc2e4810acd286cc9689e96e34db5
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
94ce6dc0280d294f50270522b9053bd8b9da26fa47c8641b20a6aca108fb39b2
973bbb07fc273e75591790d1bdfbd79c64efea26be4aaaa821942ce979ca1559
981898ccfc444d54beb452d380c685515410830fb12494784729fd1eaa68167f
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9ade9bd9e08fd903669cbadd1c2ab4a8ad90e0cb5751ddff7bf871bdbca007b0
9c61c9dd04e0f163b6f41a3139abc3dbc8162ef89455d518c302c8a148332f37
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a27ba461461cf227fad341e7e38f9e0f5d274734770950af435e8ff068ffa242
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a4a43521cee4006a9d54ffc1e769752ea89ea213e5474e886a32a5b7613163c3
a5514acb09d88f85f7960ccce359b8e57bbafebaa32b1810b9ac620024772979
a94eb62779f011f360ef902b0d15554867ff16a86aa0e3fcdf257177fd8ceb87
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
b23e846d50576bc1d79878f8ac9e7a12ed457a8afd3b9b3cf7cae810831c6591
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
beda5f60d367081085605ed76d41af63900d5afdab50d9dc5f1377af32e622c1
c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34
c200042c1052143789767de2f9311ef48e628f75652a38049a69b4d638c48200
c4320e6b2508b16ba78f8f90eb747e8927695a494a235f512f803b779618a7ac
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
c7a1b7b76d4f4e882c74b9c90c8f4c866042956843002bb8a1e4c84fe161c3c3
c7ec8f4f61d81af95253c861bd5164cd8ac2eceac931f6385651717389e614f5
c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a
cb332c513481e682f5a087a5be5f3956277cc4f940568a872ab87c14ad536443
cde97b4d863db88fb8d427ca01d2b30ce978eef755ea178a93a71d2494caeb78
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d262ea4abf9d2cca72b80812807123b883165d3404d384a58fd950021568fb98
d447a49fa9eee2c16db401b1a6c62e2bd605bf52e74e2fb066f1a819a87753e0
d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa
d8435911753d7e931e1dda44b3ec12ce5158d6389131eadb584f0097a809c901
d8b743a03a567d9929ef8410bcf067ddccea462906b6f3af1dbffc375860bdf7
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd8c9abf2e84beb86d68533601a6bfe85881ff1d974e3354aa29937dcbb60ee3
e2278458d4ed45932ff7813793b083ebae18e8bb206180821673d6384d54bf5d
e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2de29410b7099cade537d668b4b086df180df25c8a1a874648282d6054e785
f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55
f52e4e999a441c151183d77efd6dad3915e650409ea65b94b7e0fc067dcd0abd
f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fcdbb836fdddf19a49a6161d6901356e4b64240a5328493c3458a1d99aeee487
fd9ee23548e148a3798e79ae0553689b81675afe6791f53d5e8af20973e6a7b0
ff41f2c37c522b1922dbdf343e6addf024fd52290ee1248333689d9683395406

arstechnica.com Open in urlscan Pro 3.20.147.38 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

158 Requests

99 %HTTPS

32 %IPv6

36 Domains

59 Subdomains

49 IPs

6 Countries

2406 kBTransfer

5711 kBSize

3 Cookies

23 Outgoing links

Redirected requests

158 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

arstechnica.com Open in urlscan Pro
3.20.147.38 Public Scan

Screenshot
Live screenshot

Full Image

158
Requests

99 %
HTTPS

32 %
IPv6

36
Domains

59
Subdomains

49
IPs

6
Countries

2406 kB
Transfer

5711 kB
Size

3
Cookies

158 HTTP transactions
13 data transactions