URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-rea...
Submission: On September 26 via api from US

Summary

This website contacted 86 IPs in 8 countries across 65 domains to perform 266 HTTP transactions. The main IP is 50.31.169.131, located in Bensenville, United States and belongs to SERVERCENTRAL - Server Central Network, US. The main domain is arstechnica.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 16th 2019. Valid for: 2 years.
This is the only time arstechnica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 50.31.169.131 23352 (SERVERCEN...)
15 205.234.175.175 30081 (CACHENETW...)
7 2a00:1450:400... 15169 (GOOGLE)
3 143.204.211.231 16509 (AMAZON-02)
6 2.18.234.21 16625 (AKAMAI-AS)
14 2.18.235.40 16625 (AKAMAI-AS)
1 143.204.214.32 16509 (AMAZON-02)
2 2.18.232.23 16625 (AKAMAI-AS)
3 143.204.214.13 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 151.139.128.10 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 143.204.214.107 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
11 172.217.16.162 15169 (GOOGLE)
1 3.9.50.161 16509 (AMAZON-02)
2 2.18.234.190 16625 (AKAMAI-AS)
2 34.230.155.118 14618 (AMAZON-AES)
2 143.204.208.228 16509 (AMAZON-02)
1 3 52.212.161.170 16509 (AMAZON-02)
8 2a00:1450:400... 15169 (GOOGLE)
1 91.228.74.183 27281 (QUANTCAST)
1 46.228.164.13 56396 (TURN)
6 2a03:2880:f01... 32934 (FACEBOOK)
1 151.101.112.157 54113 (FASTLY)
1 143.204.214.126 16509 (AMAZON-02)
1 35.190.92.63 15169 (GOOGLE)
1 54.200.217.108 16509 (AMAZON-02)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 52.1.219.33 14618 (AMAZON-AES)
1 13.32.158.173 16509 (AMAZON-02)
2 52.239.137.4 8075 (MICROSOFT...)
1 3 23.43.115.95 20940 (AKAMAI-ASN1)
2 4 35.227.248.159 15169 (GOOGLE)
1 52.19.1.241 16509 (AMAZON-02)
2 151.101.112.239 54113 (FASTLY)
1 2600:9000:20b... 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 2 35.190.59.101 15169 (GOOGLE)
26 3.213.111.171 14618 (AMAZON-AES)
2 52.50.119.187 16509 (AMAZON-02)
2 63.140.41.50 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 2a00:1450:400... 15169 (GOOGLE)
5 2606:4700::68... 13335 (CLOUDFLAR...)
7 2.18.232.28 16625 (AKAMAI-AS)
1 2600:9000:20b... 16509 (AMAZON-02)
2 34.98.72.95 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 64.202.112.31 22075 (AS-OUTBRAIN)
1 54.236.123.155 14618 (AMAZON-AES)
1 104.244.42.133 13414 (TWITTER)
2 35.186.226.184 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 91.228.74.189 27281 (QUANTCAST)
1 52.22.222.12 14618 (AMAZON-AES)
2 3.209.40.151 14618 (AMAZON-AES)
3 2a03:2880:f11... 32934 (FACEBOOK)
1 178.250.2.130 44788 (ASN-CRITE...)
1 2 54.76.88.219 16509 (AMAZON-02)
4 104.17.192.78 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 11 152.199.22.24 15133 (EDGECAST)
2 69.173.144.142 26667 (RUBICONPR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 52.10.35.234 16509 (AMAZON-02)
2 2 185.33.223.209 29990 (ASN-APPNEXUS)
7 35.167.98.6 16509 (AMAZON-02)
2 2 185.64.189.110 62713 (AS-PUBMATIC)
1 1 216.58.207.34 15169 (GOOGLE)
1 1 178.162.133.149 60781 (LEASEWEB-...)
22 143.204.208.86 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 151.101.114.2 54113 (FASTLY)
3 2a00:1450:400... 15169 (GOOGLE)
4 13.32.222.190 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
5 143.204.214.44 16509 (AMAZON-02)
1 64.202.112.127 22075 (AS-OUTBRAIN)
1 35.190.40.172 15169 (GOOGLE)
1 52.43.157.238 16509 (AMAZON-02)
2 35.171.99.132 14618 (AMAZON-AES)
2 35.201.67.47 15169 (GOOGLE)
1 104.244.42.131 13414 (TWITTER)
1 2 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2620:119:50e4... 14413 (LINKEDIN)
2 3.225.242.81 14618 (AMAZON-AES)
2 178.250.2.152 44788 (ASN-CRITE...)
266 86
Apex Domain
Subdomains
Transfer
33 condenastdigital.com
pixel.condenastdigital.com
capture.condenastdigital.com
infinityid.condenastdigital.com
4d.condenastdigital.com
wren.condenastdigital.com
21 KB
33 cloudfront.net
d1z2jf7jlzjs58.cloudfront.net
dwgyu36up6iuz.cloudfront.net
d2c8v52ll5s99u.cloudfront.net
dp8hsntg6do36.cloudfront.net
1 MB
15 moatads.com
z.moatads.com
mb.moatads.com
px.moatads.com
429 KB
15 arstechnica.net
cdn.arstechnica.net
1009 KB
13 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
pubads.g.doubleclick.net
95 KB
11 advertising.com
adserver-us.adtech.advertising.com
2 KB
10 ad.gt
a.ad.gt
p.ad.gt
ids.ad.gt
pixels.ad.gt
14 KB
8 outbrainimg.com
tcheck.outbrainimg.com
log.outbrainimg.com
images.outbrainimg.com
41 KB
8 google-analytics.com
www.google-analytics.com
21 KB
7 skimresources.com
s.skimresources.com
r.skimresources.com
p.skimresources.com
t.skimresources.com
17 KB
6 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
181 KB
6 facebook.net
connect.facebook.net
239 KB
5 polarcdn-terrax.com
polarcdn-terrax.com
18 KB
5 demdex.net
dpm.demdex.net
condenast.demdex.net
10 KB
5 google.com
adservice.google.com
ampcid.google.com
www.google.com
1 KB
5 cnevids.com
player.cnevids.com
api.cnevids.com
61 KB
5 googletagservices.com
www.googletagservices.com
130 KB
5 arstechnica.com
arstechnica.com
sstats.arstechnica.com
17 KB
4 casalemedia.com
as-sec.casalemedia.com
13 KB
4 polarcdn-pentos.com
polarcdn-pentos.com
796 B
4 tapad.com
pixel.tapad.com
1 KB
4 quantserve.com
secure.quantserve.com
pixel.quantserve.com
7 KB
4 outbrain.com
widgets.outbrain.com
odb.outbrain.com
mcdp-nydc1.outbrain.com
46 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
2 KB
3 googleapis.com
imasdk.googleapis.com
114 KB
3 facebook.com
www.facebook.com
495 B
3 parsely.com
srv-2019-09-26-18.config.parsely.com
srv-2019-09-26-18.pixel.parsely.com
1 KB
3 scorecardresearch.com
sb.scorecardresearch.com
1 KB
3 medtargetsystem.com
www.medtargetsystem.com
52 KB
3 bounceexchange.com
tag.bounceexchange.com
assets.bounceexchange.com
91 KB
3 google.de
adservice.google.de
ampcid.google.de
www.google.de
528 B
3 amazon-adsystem.com
c.amazon-adsystem.com
25 KB
2 criteo.com
bidder.criteo.com
426 B
2 pubmatic.com
image2.pubmatic.com
1 KB
2 adnxs.com
secure.adnxs.com
2 KB
2 rubiconproject.com
fastlane.rubiconproject.com
3 KB
2 adsrvr.org
match.adsrvr.org
1016 B
2 snapchat.com
tr.snapchat.com
2 windows.net
optanon.blob.core.windows.net
25 KB
2 licdn.com
snap.licdn.com
5 KB
2 mediavoice.com
cdn.mediavoice.com
plugin.mediavoice.com
125 KB
2 adobedtm.com
assets.adobedtm.com
42 KB
2 actionbutton.co
embed.actionbutton.co
prod-native.actionbutton.co
17 KB
2 indexww.com
js-sec.indexww.com
32 KB
1 twitter.com
analytics.twitter.com
434 B
1 consensu.org
api.skimlinks.mgr.consensu.org
636 B
1 2mdn.net
s0.2mdn.net
10 KB
1 onetrust.com
geolocation.onetrust.com
325 B
1 sonobi.com
sync.go.sonobi.com
745 B
1 jquery.com
code.jquery.com
30 KB
1 plrsrvcs.com
bw-prod.plrsrvcs.com
3 KB
1 criteo.net
static.criteo.net
27 KB
1 polarcdn.com
static.polarcdn.com
118 KB
1 t.co
t.co
167 B
1 quantcount.com
rules.quantcount.com
2 KB
1 everesttech.net
cm.everesttech.net
527 B
1 zqtk.net
segment-data.zqtk.net
1012 B
1 sc-static.net
sc-static.net
6 KB
1 sail-horizon.com
ak.sail-horizon.com
42 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 turn.com
d.turn.com
698 B
1 arsdev.net
cdn.accelerator.arsdev.net
344 B
1 googletagmanager.com
www.googletagmanager.com
65 KB
0 rkdms.com Failed
mid.rkdms.com Failed
0 rlcdn.com Failed
api.rlcdn.com Failed
266 65
Domain Requested by
26 capture.condenastdigital.com arstechnica.com
22 dwgyu36up6iuz.cloudfront.net arstechnica.com
d2c8v52ll5s99u.cloudfront.net
15 cdn.arstechnica.net arstechnica.com
11 adserver-us.adtech.advertising.com 7 redirects arstechnica.com
10 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
arstechnica.com
9 px.moatads.com arstechnica.com
8 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
7 ids.ad.gt arstechnica.com
6 images.outbrainimg.com arstechnica.com
6 connect.facebook.net arstechnica.com
connect.facebook.net
d2c8v52ll5s99u.cloudfront.net
5 dp8hsntg6do36.cloudfront.net arstechnica.com
d2c8v52ll5s99u.cloudfront.net
5 polarcdn-terrax.com cdn.mediavoice.com
plugin.mediavoice.com
static.polarcdn.com
arstechnica.com
5 z.moatads.com arstechnica.com
securepubads.g.doubleclick.net
d2c8v52ll5s99u.cloudfront.net
5 www.googletagservices.com arstechnica.com
securepubads.g.doubleclick.net
4 d2c8v52ll5s99u.cloudfront.net player.cnevids.com
imasdk.googleapis.com
d2c8v52ll5s99u.cloudfront.net
4 as-sec.casalemedia.com js-sec.indexww.com
4 polarcdn-pentos.com static.polarcdn.com
4 tpc.googlesyndication.com securepubads.g.doubleclick.net
4 pixel.tapad.com 2 redirects arstechnica.com
3 imasdk.googleapis.com player.cnevids.com
imasdk.googleapis.com
3 www.facebook.com arstechnica.com
connect.facebook.net
3 pixel.quantserve.com arstechnica.com
3 sb.scorecardresearch.com 1 redirects arstechnica.com
www.googletagmanager.com
3 www.medtargetsystem.com arstechnica.com
www.medtargetsystem.com
3 dpm.demdex.net 1 redirects arstechnica.com
3 player.cnevids.com arstechnica.com
cdn.arstechnica.net
player.cnevids.com
3 c.amazon-adsystem.com arstechnica.com
c.amazon-adsystem.com
3 arstechnica.com arstechnica.com
cdn.arstechnica.net
2 bidder.criteo.com static.criteo.net
2 wren.condenastdigital.com cdn.arstechnica.net
2 pagead2.googlesyndication.com
2 px.ads.linkedin.com 1 redirects
2 t.skimresources.com s.skimresources.com
2 srv-2019-09-26-18.pixel.parsely.com arstechnica.com
2 image2.pubmatic.com 2 redirects
2 secure.adnxs.com 2 redirects
2 fastlane.rubiconproject.com js-sec.indexww.com
2 match.adsrvr.org 1 redirects js-sec.indexww.com
2 4d.condenastdigital.com pixel.condenastdigital.com
2 www.google.com 1 redirects securepubads.g.doubleclick.net
2 tr.snapchat.com sc-static.net
2 assets.bounceexchange.com tag.bounceexchange.com
assets.bounceexchange.com
2 sstats.arstechnica.com arstechnica.com
2 condenast.demdex.net arstechnica.com
2 p.skimresources.com arstechnica.com
2 r.skimresources.com 1 redirects arstechnica.com
2 pixel.condenastdigital.com arstechnica.com
2 optanon.blob.core.windows.net www.googletagmanager.com
optanon.blob.core.windows.net
2 snap.licdn.com arstechnica.com
snap.licdn.com
2 d1z2jf7jlzjs58.cloudfront.net arstechnica.com
d1z2jf7jlzjs58.cloudfront.net
2 api.cnevids.com cdn.arstechnica.net
2 widgets.outbrain.com cdn.arstechnica.net
widgets.outbrain.com
2 adservice.google.com www.googletagservices.com
imasdk.googleapis.com
2 assets.adobedtm.com arstechnica.com
assets.adobedtm.com
2 js-sec.indexww.com arstechnica.com
1 pubads.g.doubleclick.net d2c8v52ll5s99u.cloudfront.net
1 www.linkedin.com 1 redirects
1 analytics.twitter.com static.ads-twitter.com
1 pixels.ad.gt p.ad.gt
1 api.skimlinks.mgr.consensu.org s.skimresources.com
1 mcdp-nydc1.outbrain.com widgets.outbrain.com
1 s0.2mdn.net imasdk.googleapis.com
1 odb.outbrain.com widgets.outbrain.com
1 geolocation.onetrust.com code.jquery.com
1 sync.go.sonobi.com 1 redirects
1 cm.g.doubleclick.net 1 redirects
1 p.ad.gt a.ad.gt
1 code.jquery.com optanon.blob.core.windows.net
1 bw-prod.plrsrvcs.com static.polarcdn.com
1 static.criteo.net js-sec.indexww.com
1 infinityid.condenastdigital.com pixel.condenastdigital.com
1 static.polarcdn.com securepubads.g.doubleclick.net
1 www.google.de arstechnica.com
1 stats.g.doubleclick.net 1 redirects
1 t.co arstechnica.com
1 srv-2019-09-26-18.config.parsely.com d1z2jf7jlzjs58.cloudfront.net
1 log.outbrainimg.com widgets.outbrain.com
1 ampcid.google.de www.google-analytics.com
1 rules.quantcount.com secure.quantserve.com
1 tcheck.outbrainimg.com widgets.outbrain.com
1 plugin.mediavoice.com cdn.mediavoice.com
1 ampcid.google.com www.google-analytics.com
1 cm.everesttech.net 1 redirects
1 prod-native.actionbutton.co embed.actionbutton.co
1 segment-data.zqtk.net arstechnica.com
1 sc-static.net arstechnica.com
1 a.ad.gt www.googletagmanager.com
1 tag.bounceexchange.com arstechnica.com
1 ak.sail-horizon.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 d.turn.com arstechnica.com
1 secure.quantserve.com www.googletagmanager.com
1 mb.moatads.com z.moatads.com
1 adservice.google.de www.googletagservices.com
1 cdn.accelerator.arsdev.net cdn.arstechnica.net
1 www.googletagmanager.com arstechnica.com
1 s.skimresources.com arstechnica.com
1 cdn.mediavoice.com arstechnica.com
1 embed.actionbutton.co arstechnica.com
0 mid.rkdms.com Failed js-sec.indexww.com
0 api.rlcdn.com Failed js-sec.indexww.com
266 101
Subject Issuer Validity Valid
*.arstechnica.com
Sectigo RSA Domain Validation Secure Server CA
2019-01-16 -
2021-01-15
2 years crt.sh
*.cachefly.net
GlobalSign RSA OV SSL CA 2018
2019-09-18 -
2021-10-29
2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
c.amazon-adsystem.com
Amazon
2018-12-18 -
2019-11-21
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
*.actionbutton.co
Go Daddy Secure Certificate Authority - G2
2019-06-25 -
2020-06-27
a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2021-07-01
2 years crt.sh
*.cnevids.com
Trusted Secure Certificate Authority 5
2017-01-10 -
2020-01-10
3 years crt.sh
ssl962336.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-01-25 -
2019-12-11
a year crt.sh
*.skimresources.com
DigiCert SHA2 Secure Server CA
2018-09-13 -
2020-10-07
2 years crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.accelerator.arsdev.net
Amazon
2019-08-22 -
2020-09-22
a year crt.sh
*.google.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA
2018-12-14 -
2020-03-14
a year crt.sh
*.cloudfront.net
DigiCert Global CA G2
2019-07-17 -
2020-07-05
a year crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA
2018-10-16 -
2019-10-21
a year crt.sh
*.turn.com
DigiCert SHA2 Secure Server CA
2019-01-25 -
2020-03-31
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-08-24 -
2019-10-19
2 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2019-08-14 -
2020-08-18
a year crt.sh
ak.sail-horizon.com
Amazon
2019-03-06 -
2020-04-06
a year crt.sh
tag.bounceexchange.com
Let's Encrypt Authority X3
2019-08-25 -
2019-11-23
3 months crt.sh
*.ad.gt
Amazon
2019-07-06 -
2020-08-06
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2019-04-01 -
2021-05-07
2 years crt.sh
medtargetsystem.com
Amazon
2018-11-23 -
2019-12-23
a year crt.sh
sc-static.net
DigiCert SHA2 Secure Server CA
2019-03-11 -
2021-03-15
2 years crt.sh
*.blob.core.windows.net
Microsoft IT TLS CA 5
2019-05-01 -
2021-05-01
2 years crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.tapad.com
DigiCert SHA2 Secure Server CA
2018-01-17 -
2019-11-02
2 years crt.sh
*.zqtk.net
COMODO RSA Domain Validation Secure Server CA
2018-08-09 -
2020-08-24
2 years crt.sh
condenast.com
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-24 -
2020-08-07
10 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
sstats.arstechnica.com
DigiCert SHA2 High Assurance Server CA
2019-03-03 -
2020-06-05
a year crt.sh
ssl446800.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-13 -
2020-03-21
6 months crt.sh
*.outbrainimg.com
DigiCert SHA2 Secure Server CA
2019-02-24 -
2020-05-25
a year crt.sh
assets.bounceexchange.com
Let's Encrypt Authority X3
2019-08-13 -
2019-11-11
3 months crt.sh
*.config.parsely.com
Amazon
2019-02-27 -
2020-03-27
a year crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
tr.snapchat.com
DigiCert SHA2 Secure Server CA
2019-02-19 -
2021-02-23
2 years crt.sh
www.google.de
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
ssl962736.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-12-19 -
2019-12-11
a year crt.sh
*.conde.io
Amazon
2019-06-03 -
2020-07-03
a year crt.sh
*.criteo.net
DigiCert ECC Secure Server CA
2019-03-26 -
2020-03-30
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
ssl887612.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-29 -
2020-03-06
6 months crt.sh
ssl880796.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-07-31 -
2020-02-06
6 months crt.sh
*.adtech.advertising.com
DigiCert SHA2 High Assurance Server CA
2018-05-22 -
2020-05-26
2 years crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-01-10 -
2021-01-14
2 years crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh
*.onetrust.com
DigiCert SHA2 Secure Server CA
2018-03-12 -
2020-06-14
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
*.googleapis.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.doubleclick.net
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
api.skimlinks.mgr.consensu.org
DigiCert SHA2 Secure Server CA
2018-08-15 -
2019-10-23
a year crt.sh
*.pixel.parsely.com
Amazon
2019-02-27 -
2020-03-27
a year crt.sh
www.google.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2019-05-29 -
2021-06-29
2 years crt.sh
*.criteo.com
DigiCert ECC Secure Server CA
2019-03-28 -
2020-04-01
a year crt.sh

This page contains 17 frames:

Primary Page: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Frame ID: C379F0DC7F56AA8045DFBDD903869330
Requests: 210 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: EDEEC44434D10A0DF6D88FF68277C549
Requests: 1 HTTP requests in this frame

Frame: https://prod-native.actionbutton.co/?isNativeEmbed=true&589a673a-7b6b-491d-a031-ea8c4e557d6b
Frame ID: 9D5CE802C4EEE1BFD86F2CA43E8C0CFA
Requests: 1 HTTP requests in this frame

Frame: https://condenast.demdex.net/dest5.html?d_nsid=0
Frame ID: BA9CCF472E6137A894168A4DE7073B5A
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i
Frame ID: 9B79AC105AC9852F15E239A14C1C8F11
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssOpFBp_WqwFBxRWDlKkJ1pIKHG5Lfju0AHOe1vs8wSmSeYKon-2WDngmrfx6c0WBm1WPFmcas32sy4Jrm8hzXHU8W85qwfwBdpSEftsowijUWKjEpTKRWYAtzoIBRPqUDW4TKUU_eRi-d3nZDeZHDL8hvHfAcLETfZLOT8sVUot9gIFIO1i9FpE5OmrSRxAVfcHlBZFGCTTD8ySyydO5sp25JIz8JW7HTOMTKsbwQj25ZqxqIgLHX242qlOhNZqhi0_HzQLXOq9sYK0bsMzd4y4C2j&sig=Cg0ArKJSzP3fr5omvCjdEAE&urlfix=1&adurl=
Frame ID: 70767526D5BF530D7D8D2A73AE859040
Requests: 11 HTTP requests in this frame

Frame: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Frame ID: 34CDE94F3F8F4360A20CDF91C13B4B21
Requests: 1 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame10.min.html
Frame ID: E173AEE913AFA10213EEFB04A864A42E
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: 7C2B514DFCD642BB1BFDEC2698229B47
Requests: 1 HTTP requests in this frame

Frame: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Frame ID: 8434C4B9C4BEAFF971CF821BA1B20D3D
Requests: 1 HTTP requests in this frame

Frame: https://www.medtargetsystem.com/beacon/portal/?_url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_sid=f2f97105-bc19-4d18-b463-188d09348b68&_vid=02e0eaf8-8c09-43fd-93c1-df359557623d&_ak=119-556-B0E9F642&_flash=false&_th=1569522046|1569522046|1
Frame ID: 7668DFCDC25ED4299A345E9158E978DC
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Frame ID: 319121F5599827DEE4231A06B523981D
Requests: 36 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 0F18AAA013B9A5AEC8D79D94E4F92614
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.335.0_en.html
Frame ID: C9D6FF3B27846C47F1D5A65170381973
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: F1219DA416311B7CA2576FF4B385B50F
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuBIxNh_5Ob52g9bEyEfFNjf8nNYqAoxPi6r0OhuwpNLokdyM4e6DMlNRDTsdWYq1gv94I6URPmcGnNp3fUlRiT8vhW1lX77vmvs584HOeP9D8fsvFc_150latMAlgWniSvIqWEY_6TTXyxHrR5FOoivKe3-QeKHSt9Hgosmo10RLhGtXtOYSb9ma6AAptSsPftpX14uL0iacQ6tVDVTOvE7fLCILicnoNNB8k1MBTPxj5bnmGgOyPFjz4UK3icGEIPiMFjMMyqoB3eH0-5gPxiib_8k1ZT5XEowS3vKJkyciK0jceRJg&sig=Cg0ArKJSzNrnvtZl9uqbEAE&urlfix=1&adurl=
Frame ID: 377D0960C195E18029C85BDB2B869EA5
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssFM_AIyY-82Yy76bpTGWZ_FjjFn_8wms8Pv-9LQcfBgtnaUjRGWclHJl1zyiwIs7DTq1XvgQzd42jHR-R7nNdCNLa3skDeTvTscHLRG-xjFjdzwvk0dhnfJEyY5LfS8bkdxj5uMuubYtGItPAM5iVqODxaKQ896XFvmFeUpFEW5xqxl1OszVtwg0YMjc0uVa2ADk29REO18QgBKI5glZ61GoH7ktEsDDH8PWBd_b76I2xRTj-6pyXBfMdQa8ebnnQNej6tJiYXUIzne-vTwohXCsu8pXZk1_eRF4q_o8HXsNRPwg&sig=Cg0ArKJSzG8D7EFHJofSEAE&adurl=
Frame ID: B7851198C7ABED59843D3E79487CD3F6
Requests: 8 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /\.quantserve\.com\/quant\.js/i

Page Statistics

266
Requests

98 %
HTTPS

28 %
IPv6

65
Domains

101
Subdomains

86
IPs

8
Countries

4556 kB
Transfer

10475 kB
Size

17
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%20Technica&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%20Technica&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&c9=
Request Chain 62
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=undefined HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_device_id=undefined
Request Chain 63
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=648&partner_device_id=undefined HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=648&partner_device_id=undefined
Request Chain 72
  • https://r.skimresources.com/api/ HTTP 307
  • https://r.skimresources.com/api/?xguid=01DNQCVN96X1JPDD5S79AYFMCW&persistence=1&checksum=031fedf1cc3f4cd4ce8ab0b1a53b655e7a512c6cd24034a3c87e5665a1759b6f
Request Chain 79
  • https://cm.everesttech.net/cm/dd?d_uuid=25585191066055673402853426108189879989 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XY0BfgAAFOg6jRKk
Request Chain 101
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&gjid=1725691387&_gid=1254782137.1569522046&_u=aChAgUAjAAQC~&z=1320917498 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498&slf_rd=1&random=2752521179
Request Chain 130
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A5c39d52a-e08a-11e9-865e-12ddab465c88;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6
Request Chain 131
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q
Request Chain 135
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A5c39456a-e08a-11e9-a3d4-1215cb940d7a;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY
Request Chain 136
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A5c39c6ac-e08a-11e9-b7d5-12795fd23bd8;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j
Request Chain 142
  • https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=$UID HTTP 302
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3Def86d117-724c-4cea-a262-6d0d725e61f2%26adnxs_id%3D%24UID HTTP 302
  • https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=8030735307538656780
Request Chain 143
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=ef86d117-724c-4cea-a262-6d0d725e61f2 HTTP 302
  • https://ids.ad.gt/api/v1/t_match?tdid=21d83b07-7ac2-4f9b-917b-72c95b99b35c&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Request Chain 144
  • https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3Def86d117-724c-4cea-a262-6d0d725e61f2 HTTP 302
  • https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3Def86d117-724c-4cea-a262-6d0d725e61f2 HTTP 302
  • https://ids.ad.gt/api/v1/pbm_match?pbm=14DC5BB2-B855-4DDE-8021-68BDF852E977&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Request Chain 145
  • https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=ef86d117-724c-4cea-a262-6d0d725e61f2 HTTP 302
  • https://ids.ad.gt/api/v1/g_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&google_gid=CAESEFbJ9vE1WNrbBmY5TUuzpEE&google_cver=1&google_ula=450542624,0
Request Chain 146
  • https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=[UID] HTTP 302
  • https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=46168c59-7b6c-4cdd-8c22-63d25fe58770
Request Chain 147
  • https://dpm.demdex.net/ibs:dpid=348447&dpuuid=ef86d117-724c-4cea-a262-6d0d725e61f2&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3Def86d117-724c-4cea-a262-6d0d725e61f2 HTTP 302
  • https://ids.ad.gt/api/v1/adb_match?adb=25585191066055673402853426108189879989&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Request Chain 262
  • https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&fmt=js&s=1 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1569522048257%26pid%3D434737%26url%3Dhttps%253A%252F%252Farstechnica.com%252Finformation-technology%252F2019%252F09%252Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%252F%26fmt%3Djs%26s%3D1%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&fmt=js&s=1&liSync=true

266 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
43 KB
14 KB
Document
General
Full URL
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.31.169.131 Bensenville, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS
ge-11-2-1.ar10.ord6.us.scnet.net
Software
nginx /
Resource Hash
447751905a61c0f566599777b07619b8d9f74c452057d243f2fa2355e1e0907d
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
arstechnica.com
:scheme
https
:path
/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Thu, 26 Sep 2019 18:20:45 GMT
content-type
text/html; charset=UTF-8
link
<https://arstechnica.com/wp-json/>; rel="https://api.w.org/"
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-frame-options
SAMEORIGIN
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
x-ars-server
web204
content-encoding
gzip
main-90a2b7483e.css
cdn.arstechnica.net/wp-content/themes/ars/assets/css/
344 KB
71 KB
Stylesheet
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
c1288f37600dbeda8dd44de4f45b39cef9e323a71e6be0bfaab189a17abebd41

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
72767
x-cf-tsc
1569370225
x-cf2
H
last-modified
Wed, 25 Sep 2019 00:02:47 GMT
server
CFS 0215
x-cff
B
etag
W/"5d8aaea7-55eed"
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
gpt.js
www.googletagservices.com/tag/js/
44 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5b488a95c177794d76da1b479bf56facc088949a87771cc6e1458651f4dc8974
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"291 / 265 of 1000 / last-modified: 1569513999"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
14271
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:45 GMT
apstag.js
c.amazon-adsystem.com/aax2/
75 KB
22 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.211.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-211-231.fra53.r.cloudfront.net
Software
Server /
Resource Hash
433bdabdad57a971a481ad56d60e2258f985997b4917f0102085d75aba411296

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 17:26:21 GMT
content-encoding
gzip
server
Server
age
3264
etag
f0bac670699a8e733c8152bbeef38044
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=86400
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
t3NkXEkiwI5MH9udFBGHujmFkok4Ig05MU_l-Q2PcLWoF3lL9BtaDQ==
via
1.1 ab39b007ab81966ada6e7fb1536bf377.cloudfront.net (CloudFront)
183973-1558632223658.js
js-sec.indexww.com/ht/p/
116 KB
32 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4a64765dec5cd339627825bfc0dab7df162ec8de3588ce7273cda5bdfd414330

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 18:20:41 GMT
Server
Apache
ETag
"760c03-1ce08-59378d3be5b62"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3562
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
32219
Expires
Thu, 26 Sep 2019 19:20:08 GMT
moatheader.js
z.moatads.com/condenastprebidheader987326845656/
85 KB
33 KB
Script
General
Full URL
https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
a4b1778a87595cf9ae9f5895ec53d8d0c7b14bcd2b8e83e97205de93d9e2d302

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:45 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Jun 2019 22:46:08 GMT
Server
AmazonS3
x-amz-request-id
51EAAEE1F3A29B96
ETag
"72a5c50e4e39e0e8cb0219a5569deff3"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=54901
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32968
x-amz-id-2
F2Qao5shCYQu5cyq2mkNzxqmDgSvsHK2qYzrkz+Di8nW/PuM/rPl05Z4Q7PUU1iE5krHHF6wvyU=
ars-technica.min.js
cdn.arstechnica.net/cns/
124 KB
40 KB
Script
General
Full URL
https://cdn.arstechnica.net/cns/ars-technica.min.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
4704fca31cd15f83a91c67e58a9acd46cf491d78fb2e2f8a6be760c8ae8cee7f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-cf3
H
x-amz-request-id
AF8E2689A2CAEBF5
x-cf1
14961:fD.fra2:co:1565891882:cacheN.fra2-01:H
status
200
x-cache-hits
1
content-length
40704
x-amz-id-2
q0AtTMdtqNrlc4NzqqqpGDhtMvR+f99cqQVy0G7JuIhrUoUmaYeOSbf9leXue/aEoV2Ai8YMpnQ=
x-cf-tsc
1565891888
cf4ttl
120.500
x-cf2
H
last-modified
Wed, 14 Aug 2019 18:21:19 GMT
server
CFS 0215
x-timer
S1565891884.224418,VS0,VE1
x-cff
B
etag
"b8d20846df2b07a8b4072cb23bafe08d"
x-served-by
cache-mdw17351-MDW
vary
Accept-Encoding
x-amz-version-id
bdz._zghS79PEfT1GhkY3IJ8qXL9HWZY
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
5
accept-ranges
bytes
content-type
application/javascript
x-cf-rand
1.472
expires
Thu, 21 Nov 2019 18:20:45 GMT
ars-bcfee6c82a.ads.us.js
arstechnica.com/wp-content/themes/ars/assets/js/
4 KB
2 KB
Script
General
Full URL
https://arstechnica.com/wp-content/themes/ars/assets/js/ars-bcfee6c82a.ads.us.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.31.169.131 Bensenville, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS
ge-11-2-1.ar10.ord6.us.scnet.net
Software
nginx /
Resource Hash
032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 25 Sep 2019 15:46:33 GMT
server
nginx
etag
W/"5d8b8bd9-e66"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
strict-transport-security
max-age=300
x-ars-server
web204
x-xss-protection
1; mode=block
androidadmalware-800x459.png
cdn.arstechnica.net/wp-content/uploads/2019/09/
431 KB
432 KB
Image
General
Full URL
https://cdn.arstechnica.net/wp-content/uploads/2019/09/androidadmalware-800x459.png
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
76353ba24248a5e199723c62454daf6edad51e9e24f1ff0f50a01884d6eb01e6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fD.fra2:co:1569506610:cacheN.fra2-01:H
status
200
content-length
441656
x-cf-tsc
1569508972
x-cf2
H
last-modified
Thu, 26 Sep 2019 14:02:55 GMT
server
CFS 0215
x-cff
B
etag
"5d8cc50f-6bd38"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
main-639c20175b.js
cdn.arstechnica.net/wp-content/themes/ars/assets/js/
655 KB
213 KB
Script
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-639c20175b.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
0bee739dd886001c22c29558e21499bbe988f66eb4c0c9b46e42309d04f0aa06

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
217753
x-cf-tsc
1569426479
x-cf2
H
last-modified
Wed, 25 Sep 2019 15:46:33 GMT
server
CFS 0215
x-cff
B
etag
W/"5d8b8bd9-a3ba8"
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
widget.min.js
embed.actionbutton.co/widget/
53 KB
17 KB
Script
General
Full URL
https://embed.actionbutton.co/widget/widget.min.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.32 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-32.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d7aa953d2324b58988b7c3829dd3f8505ae7ac5ea94c76debb7ea9fbf8422172

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 16:25:05 GMT
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Wed, 11 Sep 2019 16:23:06 GMT
Server
AmazonS3
Age
6941
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront)
Cache-Control
no-cache
Transfer-Encoding
chunked
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
qdKIkn9dFAIbYR2_KXGDuugshkzqJcC9Gbb0V9VJYtCgzUOCJHQysA==
satelliteLib-56a425e07376b6977c987d46ef46ba636a6e2036.js
assets.adobedtm.com/6372cf21ef88ee60bc2977a4898dcb5c7945a212/
74 KB
23 KB
Script
General
Full URL
https://assets.adobedtm.com/6372cf21ef88ee60bc2977a4898dcb5c7945a212/satelliteLib-56a425e07376b6977c987d46ef46ba636a6e2036.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
27ee41d3fd05096e2e40507d7d1b6edfb71423aaaea35cfe24d0be18b6eeb006

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
last-modified
Wed, 15 May 2019 19:02:35 GMT
server
Apache
etag
"262b5b65e9b10aa157d4be8da094be2d:1557946955"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
23282
expires
Thu, 26 Sep 2019 19:20:45 GMT
arstechnica.js
player.cnevids.com/interlude/
109 KB
28 KB
Script
General
Full URL
https://player.cnevids.com/interlude/arstechnica.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.13 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-13.fra53.r.cloudfront.net
Software
nginx/1.14.1 /
Resource Hash
b7b0772e3a20ffcda7bca20f04555ad1c1fb4f31837b1263e904f2c6c76b94d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Age
39
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Status
200 OK
Connection
keep-alive
X-XSS-Protection
1; mode=block
X-Request-Id
e019ba7c-8aad-4d63-b275-f29e6cdf60b9
X-Runtime
0.025849
X-Backend-Node
10.110.29.24
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx/1.14.1
ETag
W/"c347916c64238d509a84898b90466643"
X-Download-Options
noopen
Vary
Origin,Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 d16428714e022976873ccc980fdc1289.cloudfront.net (CloudFront)
Cache-Control
max-age=0, private, must-revalidate
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
HZwBssgGp_M7737fSCcUusF_4kXomhNq3QrlNmeDSbkVL_nHUeAWuw==
conde-asa-polar-master.js
cdn.mediavoice.com/nativeads/script/condenastcorporate/
5 KB
2 KB
Script
General
Full URL
https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
cf-cache-status
HIT
age
3999
cf-ray
51c740f36d4b59ee-VIE
status
200
cf-ipcountry
DE
x-country
DE
content-length
2018
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-varnish
1608672514 1608609066
via
1.1 varnish
cache-control
max-age=21600
accept-ranges
bytes
content-type
text/javascript
100098X1555750.skimlinks.js
s.skimresources.com/js/
38 KB
15 KB
Script
General
Full URL
https://s.skimresources.com/js/100098X1555750.skimlinks.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3bf16831676488c9e6ea4aea8db26893534895101a1244c58afc1e47d713d298

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 09:09:20 GMT
server
AmazonS3
x-amz-request-id
D17AB3D7D829FEE8
etag
"2399c9a458943c6d946ad4a55aa2dc85"
x-hw
1569522045.cds066.fr8.hn,1569522045.cds026.fr8.c
content-type
application/octet-stream
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
15044
x-amz-id-2
8vrDoehmZTTf2ybgvHFolil1zhxdmmwu95Mj+Ks/Urn6hdZb5+vm84HUQjFmMy4qphxALzghpVg=
gtm.js
www.googletagmanager.com/
269 KB
65 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f2cf88d3a53228b050cb4e31ad5b4009f98456cb0f62e56eeeb119af1b6dc44e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
br
last-modified
Thu, 26 Sep 2019 18:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
66609
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:45 GMT
https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
cdn.accelerator.arsdev.net/h/
40 B
344 B
Script
General
Full URL
https://cdn.accelerator.arsdev.net/h/https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.107 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-107.fra53.r.cloudfront.net
Software
nginx/1.4.6 (Ubuntu) / PHP/5.5.9-1ubuntu4.9
Resource Hash
af3ca6fd3881542da03ed9ade1bbf78859140adc3bd3b703d977e3093c6c57fd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:24:10 GMT
via
1.1 e7377cc861b31102786678df3616bf69.cloudfront.net (CloudFront)
server
nginx/1.4.6 (Ubuntu)
x-amz-cf-pop
FRA53-C1
x-powered-by
PHP/5.5.9-1ubuntu4.9
x-cache
Miss from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=300, public
x-amz-cf-id
X5ueew7WyAUw9cXK9H_ANbeaT0jr0vYdTuLfQTIOTLuVassEkOtOIQ==
ads.js
arstechnica.com/hotzones/src/
0
517 B
XHR
General
Full URL
https://arstechnica.com/hotzones/src/ads.js
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.31.169.131 Bensenville, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS
ge-11-2-1.ar10.ord6.us.scnet.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-content-type-options
nosniff
last-modified
Wed, 25 Sep 2019 15:45:08 GMT
server
nginx
etag
"5d8b8b84-0"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
content-length
0
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
strict-transport-security
max-age=300
accept-ranges
bytes
x-ars-server
web204
x-xss-protection
1; mode=block
integrator.js
adservice.google.de/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=arstechnica.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=arstechnica.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019091901.js
securepubads.g.doubleclick.net/gpt/
156 KB
57 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
c77635c1d346c5471d294f59d0c4ef11f71c21f94e82087cbd99984c9aaa3cda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 13:07:51 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58568
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:45 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.211.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-211-231.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6d6f482982f8f1a1814e279ff50df4ccc301533ca9655e4d080d6b90ec69d69e

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 09 Sep 2019 20:14:25 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
79242
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Fri, 24 Aug 2018 07:13:51 GMT
server
AmazonS3
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 d7524ff4a82155dd51a24800cf39deec.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
fkrdtd_H7tF2ZjVj8uWd9VK0zbqCFGohhF1Y1i_L8TEBVWLBkqRmLw==
yi.js
mb.moatads.com/
1 KB
1 KB
Script
General
Full URL
https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=&iv=7&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&confidence=2&pcode=condenastprebidheader987326845656&callback=MoatNadoAllJsonpRequest_49466371
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.9.50.161 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-9-50-161.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
3a4500b0e55e94614f6abe4c89f14bef00e38e8c1efa799a7b1606e8ad69c06f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
server
TornadoServer/4.5.3
etag
"15452cf62f947760473b3315c124fe3b6c55de03"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
1197
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&na=864003308&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:45 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
357 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
economica-bold-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
25 KB
25 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-bold-otf-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
25592
x-cf-tsc
1562369429
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-63f8"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
economica-regular-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
24 KB
24 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-regular-otf-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
24264
x-cf-tsc
1562369429
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-5ec8"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
truncated
/
279 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
400 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
700 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
841 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
s.gallagher-9.jpg
cdn.arstechnica.net/wp-content/uploads/2016/05/
51 KB
51 KB
Image
General
Full URL
https://cdn.arstechnica.net/wp-content/uploads/2016/05/s.gallagher-9.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
703c68bc0eb86c90d0c6670ec0547e19a230db953c002879f2a204dd85dd8571

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
H
cf4ttl
43200.000
x-cf1
14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
51988
x-cf-tsc
1569198355
x-cf2
H
last-modified
Tue, 10 May 2016 18:23:41 GMT
server
CFS 0215
x-cff
B
etag
"5732272d-cb14"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
42994
accept-ranges
bytes
x-cf-rand
4.953
expires
Thu, 21 Nov 2019 18:20:45 GMT
channel-ars-be7bb52ba9.png
cdn.arstechnica.net/wp-content/themes/ars/assets/img/
5 KB
5 KB
Image
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/img/channel-ars-be7bb52ba9.png
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
4809
x-cf-tsc
1562286891
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-12c9"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
18 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
opensans-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
18 KB
19 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-regular-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
18824
x-cf-tsc
1562369429
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-4988"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
bitter-italic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
24 KB
24 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-italic-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
24212
x-cf-tsc
1562369692
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-5e94"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
bitter-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
22 KB
23 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-regular-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
22872
x-cf-tsc
1562369429
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-5958"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
opensans-semibold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
19 KB
19 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibold-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
18972
x-cf-tsc
1562369718
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-4a1c"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
opensans-semibolditalic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibolditalic-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
20872
x-cf-tsc
1562369718
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-5188"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
opensans-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
19 KB
19 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-bold-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
19516
x-cf-tsc
1562369864
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-4c3c"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
bitter-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/
22 KB
22 KB
Font
General
Full URL
https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-bold-webfont.woff2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-90a2b7483e.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
x-cf3
M
cf4ttl
43200.000
x-cf1
14961:fC.fra2:co:1525808045:cacheN.fra2-01:H
status
200
content-length
22104
x-cf-tsc
1562368897
x-cf2
H
last-modified
Tue, 25 Jun 2019 14:52:45 GMT
server
CFS 0215
x-cff
B
etag
"5d12353d-5658"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=4838400
cf4age
0
accept-ranges
bytes
expires
Thu, 21 Nov 2019 18:20:45 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&na=1682204279&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:45 GMT
outbrain.js
widgets.outbrain.com/
105 KB
36 KB
Script
General
Full URL
https://widgets.outbrain.com/outbrain.js?_=1569522045990
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-639c20175b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
69a003bbbbc8d36fd065b861145f56b517f85004deb705d960f665de746ccca4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 07:31:00 GMT
Server
Apache
ETag
"5497fb0168a7868fd08e1c34187c4e0f:1569407811"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=14400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
36536
video_groups
api.cnevids.com/v1/
4 KB
1 KB
XHR
General
Full URL
https://api.cnevids.com/v1/video_groups?filters={%22channel_key%22:%22arstechnica%22}&pagesize=20&endpoint=oo.arstechnica
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-639c20175b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.155.118 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-230-155-118.compute-1.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
e63b1da010fd0ae09966d8d1cb1d5a094faebea66a20c21b4f3e1c4c1abadd66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/*
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Status
200 OK
Access-Control-Max-Age
1728000
Connection
keep-alive
Content-Length
658
X-XSS-Protection
1; mode=block
X-Request-Id
9ed57bbe-372c-4b70-9e67-db0bf0a286ea
X-Runtime
0.001758
X-Backend-Node
10.110.10.11
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx/1.14.1
X-Frame-Options
SAMEORIGIN
ETag
W/"74d503208e673ac8a38a4576a624249a"
X-Download-Options
noopen
Vary
Accept-Encoding, Origin
Access-Control-Allow-Methods
GET, PUT, POST, DELETE, OPTIONS
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Cache-Control
max-age=0, private, must-revalidate
p.js
d1z2jf7jlzjs58.cloudfront.net/
6 KB
3 KB
Script
General
Full URL
https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-228.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
725913eab3460e2955a8ac4ec176f902c7d8d2db60757248b735cbf8698b0749

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 00:42:32 GMT
Content-Encoding
gzip
Age
63520
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Fri, 07 Mar 2014 00:45:07 GMT
Server
nginx
ETag
W/"53191693-19c1"
Content-Type
application/x-javascript
Via
1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront)
Cache-Control
max-age=86400, public
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
e29wFJDLTO1bSgjm6u6LRHdP8wPsdjb2k997NjjuT0U4ZDwsghLnJQ==
Expires
Thu, 26 Sep 2019 00:42:06 GMT
id
dpm.demdex.net/
6 KB
2 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F7093025512D2B690A490D44%40AdobeOrg&d_nsid=0&ts=1569522046054
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.161.170 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-161-170.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ecc03a7d8b5e87752e51b07bd77cff11b55a1d54b349babd827b6388c6606abd

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v044-075b31bfe.edge-irl1.demdex.com 5.59.0.20190904135845 6ms (+0ms)
Pragma
no-cache
Content-Encoding
gzip
X-TID
IcbubGsKT04=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
1597
Expires
Thu, 01 Jan 1970 00:00:00 GMT
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6888
date
Thu, 26 Sep 2019 16:25:58 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
17803
expires
Thu, 26 Sep 2019 18:25:58 GMT
quant.js
secure.quantserve.com/
12 KB
6 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.183 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26-Sep-2019 18:20:46 GMT
Server
QS
ETag
M0-e2b9884a
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=604800
Connection
keep-alive
Content-Length
5456
Expires
Thu, 03 Oct 2019 18:20:46 GMT
PageName=information%20technology,SiteID=Ars%20Technica,CampaignID=1802C,Channel=website,CreativeID=1bb39f54-a0d7-465b-af54-5ad2013da4db
d.turn.com/r/dd/id/L21rdC84MTYvY2lkLzI4NTk1MjExL3QvMA/kv/
253 B
698 B
Script
General
Full URL
https://d.turn.com/r/dd/id/L21rdC84MTYvY2lkLzI4NTk1MjExL3QvMA/kv/PageName=information%20technology,SiteID=Ars%20Technica,CampaignID=1802C,Channel=website,CreativeID=1bb39f54-a0d7-465b-af54-5ad2013da4db
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_CBC
Server
46.228.164.13 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
3ce6aa359a1ab6d1a97a7ea066e6be363ba4a8bfbfa78896c7bc790a3db120f2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Server
Apache-Coyote/1.1
P3P
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Content-Length
253
Content-Type
text/javascript;charset=UTF-8
fbevents.js
connect.facebook.net/en_US/
121 KB
31 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31604
x-xss-protection
0
pragma
public
x-fb-debug
dRdBLaZRBbFS7zW+yoGak2V4gvGqhvAQHlfzU4+GeAfaPl2oFz8+KaXACGKycim0aFMO3MADJO4+DrQaMvLIow==
x-fb-trip-id
194532234
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
expires
Sat, 01 Jan 2000 00:00:00 GMT
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
age
36483
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4056-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1569522046.075886,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
spm.v1.min.js
ak.sail-horizon.com/spm/
118 KB
42 KB
Script
General
Full URL
https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.126 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-126.fra53.r.cloudfront.net
Software
Apache /
Resource Hash
a1b235023f47ff6443e3d54b34363f41f20bc92cf6a72be3e42e9f12fe72ddf6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:14:36 GMT
content-encoding
gzip
last-modified
Wed, 18 Sep 2019 19:01:40 GMT
server
Apache
age
373
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
max-age=600; must-revalidate
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
43069
via
1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
x-amz-cf-id
hKjbYJtYhJhmO3ZyFYQeXtQT4_7rxnaqO6QdLXPIEygOIB8BMxTI_A==
i.js
tag.bounceexchange.com/2806/
10 KB
3 KB
Script
General
Full URL
https://tag.bounceexchange.com/2806/i.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.92.63 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
63.92.190.35.bc.googleusercontent.com
Software
fasthttp /
Resource Hash
8fa0f98b337e13021072fb55a23e68a76cc0408a66e7e4adef056dcfb8751a4f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:45 GMT
content-encoding
gzip
server
fasthttp
etag
15a023e141bad6
content-type
text/plain; charset=utf-8
status
200
cache-control
no-cache, must-revalidate
x-region
europe-west3
alt-svc
clear
content-length
3365
via
1.1 google
57
a.ad.gt/api/v1/u/matches/
3 KB
2 KB
Script
General
Full URL
https://a.ad.gt/api/v1/u/matches/57
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.200.217.108 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-200-217-108.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
91a43bc2113401f0fbfdb24ec1e22b44005f6eb04520d15c8e552c4d9745a9ad

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Server
nginx/1.8.1
Connection
keep-alive
Content-Length
1223
Content-Type
text/html; charset=utf-8
insight.min.js
snap.licdn.com/li.lms-analytics/
933 B
742 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bcb0943fb17ca96b5c4b3de682f243f02322c59bb277abea2d94b8b38f49988f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 16:50:26 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=81202
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
429
beacon.js
www.medtargetsystem.com/javascript/
176 KB
52 KB
Script
General
Full URL
https://www.medtargetsystem.com/javascript/beacon.js?v2.5.12
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.219.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-219-33.compute-1.amazonaws.com
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
ca5bf9816a06a54b2361b4a16e34d69dde1768182c8dcf28d36b5f1c761ad2dc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Sep 2019 19:13:49 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"2c0a2-591e73cea1540-gzip"
Vary
X-Forwarded-Proto,Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
52823
scevent.min.js
sc-static.net/
14 KB
6 KB
Script
General
Full URL
https://sc-static.net/scevent.min.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.158.173 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-158-173.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4d2e73fabea4a24a0278320a4920a5766ae7c7c5a11f787e0f31467a253bdddf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 02:47:30 GMT
content-encoding
gzip
last-modified
Thu, 22 Aug 2019 01:24:21 GMT
server
AmazonS3
age
55999
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, s-maxage=86400, max-age=600
x-amz-cf-pop
FRA56
x-amz-cf-id
Raqmqolzjze5JihfJdMc5_We42BhSlqWr0JrALNdXhRvseSohcZxDw==
via
1.1 7ff3248f5aef149847858a974cf62b00.cloudfront.net (CloudFront)
c941cf3b-dfcd-475f-90e4-e7f422fc89dd.js
optanon.blob.core.windows.net/consent/
136 KB
19 KB
Script
General
Full URL
https://optanon.blob.core.windows.net/consent/c941cf3b-dfcd-475f-90e4-e7f422fc89dd.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
394932783730f35682dbdd0827ee70afd0e4208ac0316d8c9199ad9b49605b9d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Thu, 26 Sep 2019 18:20:45 GMT
Content-Encoding
GZIP
Last-Modified
Sat, 03 Aug 2019 21:36:58 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
zRwj6ElJPN1qBwE5S0GzGw==
ETag
0x8D7185AB64819F8
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
x-ms-request-id
5779daa4-001e-0116-2597-745f2d000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=14400
x-ms-version
2009-09-19
Content-Length
18308
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%20Technica&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&c9=
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.43.115.95 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-43-115-95.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=6035094&ns__t=1569522046070&ns_c=UTF-8&c8=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%20Technica&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&c9=
Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=undefined
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_device_id=undefined
95 B
342 B
Image
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_device_id=undefined
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.248.159 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
159.248.227.35.bc.googleusercontent.com
Software
Jetty(8.1.13.v20130916) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
server
Jetty(8.1.13.v20130916)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
status
200
content-type
image/png
alt-svc
clear
content-length
95

Redirect headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
server
Jetty(8.1.13.v20130916)
status
302
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_device_id=undefined
alt-svc
clear
content-length
0
check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=648&partner_device_id=undefined
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=648&partner_device_id=undefined
95 B
353 B
Image
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=648&partner_device_id=undefined
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.248.159 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
159.248.227.35.bc.googleusercontent.com
Software
Jetty(8.1.13.v20130916) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
server
Jetty(8.1.13.v20130916)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
status
200
content-type
image/png
alt-svc
clear
content-length
95

Redirect headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
server
Jetty(8.1.13.v20130916)
status
302
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=648&partner_device_id=undefined
alt-svc
clear
content-length
0
s-code-contents-566dcf5046f148f38d0aa32bf73df40db7ae7768.js
assets.adobedtm.com/6372cf21ef88ee60bc2977a4898dcb5c7945a212/
67 KB
19 KB
Script
General
Full URL
https://assets.adobedtm.com/6372cf21ef88ee60bc2977a4898dcb5c7945a212/s-code-contents-566dcf5046f148f38d0aa32bf73df40db7ae7768.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/6372cf21ef88ee60bc2977a4898dcb5c7945a212/satelliteLib-56a425e07376b6977c987d46ef46ba636a6e2036.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
de4de18224e2109f2f8ff4ce9a40cb51c6a36724b2df68e8bd6080b8ee3a02d0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
last-modified
Wed, 15 May 2019 19:02:35 GMT
server
Apache
etag
"06a88b0424fa26cefa8da4fc4967b294:1557946955"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
19132
expires
Thu, 26 Sep 2019 19:20:46 GMT
conde-nast
segment-data.zqtk.net/
741 B
1012 B
Script
General
Full URL
https://segment-data.zqtk.net/conde-nast?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.1.241 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-1-241.eu-west-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
5f3af970acfb02db502def3a6f64048851fd68bcb61c619ba969b18497749718

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Expires
Sat, 28 Sep 2019 14:42:38 GMT
Last-Modified
Thu, 26 Sep 2019 14:42:38 GMT
Server
nginx/1.10.3 (Ubuntu)
Connection
keep-alive
Content-Length
741
Content-Type
application/javascript; charset=UTF-8
ixmatch.html
js-sec.indexww.com/um/ Frame EDEE
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

Server
Apache
Last-Modified
Mon, 19 Jun 2017 19:18:19 GMT
ETag
"e20015-112-55254ff6a1972"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
211
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
ars-technica.config.js
pixel.condenastdigital.com/config/v2/production/
5 KB
2 KB
Script
General
Full URL
https://pixel.condenastdigital.com/config/v2/production/ars-technica.config.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.239 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a6a60bfeca1021496ac984a7e6b7f05f9473db17edcccbc91855b302863bab76

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Age
86579
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
995
x-amz-id-2
FKPqKuelDY4dA2iUt3IPbIlId3AasfLJAnaOjax11cNTE0E1tyVcJniP6MEmpSTIVc/V8EwsGqk=
X-Served-By
cache-iad2128-IAD, cache-hhn4083-HHN
Access-Control-Allow-Origin
*
Last-Modified
Fri, 12 Apr 2019 14:56:32 GMT
Server
AmazonS3
X-Timer
S1569522046.140570,VS0,VE0
ETag
"1be0f93ab87f7c023eae8fa152ea611f"
Vary
Accept-Encoding
x-amz-request-id
52384B8AC2977F0F
Via
1.1 varnish, 1.1 varnish
Expires
Thu, 15 Aug 2019 00:17:47 GMT
Cache-Control
no-cache, public, max-age=604800
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
1, 370
/
prod-native.actionbutton.co/ Frame 9D5C
0
0
Document
General
Full URL
https://prod-native.actionbutton.co/?isNativeEmbed=true&589a673a-7b6b-491d-a031-ea8c4e557d6b
Requested by
Host: embed.actionbutton.co
URL: https://embed.actionbutton.co/widget/widget.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:7600:11:8cf6:b500:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
prod-native.actionbutton.co
:scheme
https
:path
/?isNativeEmbed=true&589a673a-7b6b-491d-a031-ea8c4e557d6b
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
content-type
text/html
date
Mon, 23 Sep 2019 19:32:39 GMT
last-modified
Mon, 23 Sep 2019 19:32:22 GMT
cache-control
max-age=31536000,public
server
AmazonS3
content-encoding
gzip
vary
Accept-Encoding
age
254888
x-cache
Hit from cloudfront
via
1.1 8bbec5871de1c2a41003db8fbeafebf8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56
x-amz-cf-id
gvi1AVdw6MXXf60GRmianvdwVnWI63pKk9oPPx26l7zexagGPhXm1w==
ads
securepubads.g.doubleclick.net/gampad/
418 B
396 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4018847106260845&correlator=1666555318833230&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&eid=21062818&vrg=2019091901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190926&iu_parts=3379%2Cconde.ars%2Cinterstitial%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ists=1&prev_scp=pos%3Dinterstitial%26ctx_slot_type%3Dout_of_page%26ctx_slot_rn%3D0%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dout_of_page_0&eri=1&cust_params=amznbid%3D0%26amznp%3D0%26m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_topic_sc%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_ent_sc%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_ctx_kw_sc%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1569522046&dt=1569522046121&dlt=1569522045603&idt=478&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=0&adks=2746652139&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dssz=63&icsg=2252798460690432&mso=262144&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x1&msz=1585x1&ga_vid=472596231.1569522046&ga_sid=1569522046&ga_hid=1264286218&fws=4&ohw=1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
363c3daa4bd8685ce2cf33417f7575e6dd7316f51b09c957b62c31b3942a4ae9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
209
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019091901.js
securepubads.g.doubleclick.net/gpt/
62 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
a29b20518a3bb583278ebb330cba43e072795b7009b39f3479819d00f0833064
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 13:07:51 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24151
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:46 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

/
r.skimresources.com/api/
Redirect Chain
  • https://r.skimresources.com/api/
  • https://r.skimresources.com/api/?xguid=01DNQCVN96X1JPDD5S79AYFMCW&persistence=1&checksum=031fedf1cc3f4cd4ce8ab0b1a53b655e7a512c6cd24034a3c87e5665a1759b6f
144 B
454 B
XHR
General
Full URL
https://r.skimresources.com/api/?xguid=01DNQCVN96X1JPDD5S79AYFMCW&persistence=1&checksum=031fedf1cc3f4cd4ce8ab0b1a53b655e7a512c6cd24034a3c87e5665a1759b6f
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
2d31de5f3c638aa20538227807c5b92d04e9a261e8068d0dc49794fa9d77bbc5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
openresty/1.11.2.5
status
200
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://arstechnica.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google

Redirect headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
server
openresty/1.11.2.5
status
307
location
//r.skimresources.com/api/?xguid=01DNQCVN96X1JPDD5S79AYFMCW&persistence=1&checksum=031fedf1cc3f4cd4ce8ab0b1a53b655e7a512c6cd24034a3c87e5665a1759b6f
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://arstechnica.com
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
193
px.gif
p.skimresources.com/
43 B
116 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=1&rn=8.596756805904574
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date
Thu, 26 Sep 2019 18:20:46 GMT
x-guploader-uploadid
AEnB2UoyCnl1Tl7okMVPji-4rLDP91trx5XUJBqCKgovMIxKZAWbFmKwrT_fNOdZS0u5Opl-mV2lwcviraedoTR9LJXIEE283g
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-hw
1569522046.cds066.fr8.hn,1569522046.cds054.fr8.c
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
px.gif
p.skimresources.com/
43 B
495 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=2&rn=8.596756805904574
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date
Thu, 26 Sep 2019 18:20:46 GMT
x-guploader-uploadid
AEnB2UoyCnl1Tl7okMVPji-4rLDP91trx5XUJBqCKgovMIxKZAWbFmKwrT_fNOdZS0u5Opl-mV2lwcviraedoTR9LJXIEE283g
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-hw
1569522046.cds066.fr8.hn,1569522046.cds054.fr8.c
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ded8aafe08adcc23835de89f62fbee0b98184f32296c7679ab5b5a358f044f63

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=&sID=&uId=&xid=&_ts=2019-09-26T18%3A20%3A46.254Z&_c=error&_t=Interlude%20Insertion%20Error&dim1=%7B%22interludeFailure%22%3A%22no%20slot%22%2C%22pageTemplate%22%3A%22report%22%2C%22url%22%3A%22information-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=Availability%3A%20no%20slot
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
Cookie set dest5.html
condenast.demdex.net/ Frame BA9C
0
0
Document
General
Full URL
https://condenast.demdex.net/dest5.html?d_nsid=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.119.187 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-50-119-187.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
condenast.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=25585191066055673402853426108189879989
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 25 Sep 2019 09:31:52 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=25585191066055673402853426108189879989;Path=/;Domain=.demdex.net;Expires=Tue, 24-Mar-2020 18:20:46 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
dqVMgVj6T8Q=
Content-Length
2764
Connection
keep-alive
id
sstats.arstechnica.com/
49 B
565 B
XHR
General
Full URL
https://sstats.arstechnica.com/id?d_visid_ver=3.3.0&d_fieldgroup=A&mcorgid=F7093025512D2B690A490D44%40AdobeOrg&mid=25794962033161343252870198543650218604&ts=1569522046265
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.41.50 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
arstechnica.com.ssl.d1.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a99f308a183c461acaf9db9d77e629f83f355deca0215a60cb3bef0519011eca

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
Omniture DC
xserver
www7157
Vary
Origin
X-C
ms-6.10.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
https://arstechnica.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
ibs:dpid=411&dpuuid=XY0BfgAAFOg6jRKk
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=25585191066055673402853426108189879989
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XY0BfgAAFOg6jRKk
42 B
776 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XY0BfgAAFOg6jRKk
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.161.170 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-161-170.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v044-01a1ffcf8.edge-irl1.demdex.com 5.59.0.20190904135845 5ms (+1ms)
Pragma
no-cache
X-TID
KwrAM02KSJc=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Thu, 26 Sep 2019 18:20:45 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XY0BfgAAFOg6jRKk
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
947 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 17:29:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
3071
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
856
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:29:35 GMT
publisher:getClientId
ampcid.google.com/v1/
74 B
463 B
XHR
General
Full URL
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
94
x-xss-protection
0
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=44&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=234572959&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:46 GMT
plugin.js
plugin.mediavoice.com/
330 KB
123 KB
Script
General
Full URL
https://plugin.mediavoice.com/plugin.js
Requested by
Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
81e4baa98023df9a9947e91a8310bb46a86d2f512a91ed408f72bda914232a5a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
cf-cache-status
HIT
age
38734
status
200
content-type
application/javascript
content-length
125285
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Wed, 18 Sep 2019 19:34:34 GMT
server
cloudflare
etag
W/"5d8286ca-52774"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
x-varnish
1954109029 1954108960
via
1.1 varnish
cache-control
max-age=43200
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
51c740f5cf0159ee-VIE
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Thu, 26 Sep 2019 19:34:56 GMT
condenastcorporate
polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/
181 B
593 B
XHR
General
Full URL
https://polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/condenastcorporate
Requested by
Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
server
cloudflare
status
200
etag
W/"4ed41fc03a3c3b67ac78af86ee19d7f1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Country, CF-Ray
cache-control
max-age=86400
x-country
DE
cf-ray
51c740f58b21cbc0-VIE
228464857488266
connect.facebook.net/signals/config/
308 KB
79 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/228464857488266?v=2.9.4&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
69932e401ffd71025f7e4bd320ea4ade764c87a91c5acd9114e69d2aaaa19615
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
79815
x-xss-protection
0
pragma
public
x-fb-debug
SyxAbvSLLGlZQZG4DMy64qBxvzndcQ89hGdbOUm4CDLQxK3aLevkKdINEat1cKH7dWs2pvWqw5mhYzn19TDMMA==
x-fb-trip-id
194532234
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
YXJzdGVjaG5pY2EuY29t
tcheck.outbrainimg.com/tcheck/check/
16 B
477 B
XHR
General
Full URL
https://tcheck.outbrainimg.com/tcheck/check/YXJzdGVjaG5pY2EuY29t
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1569522045990
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
ETag
W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age
43200
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=32246
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
false
Content-Length
16
Expires
Fri, 27 Sep 2019 03:18:12 GMT
ads
securepubads.g.doubleclick.net/gampad/
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4018847106260845&correlator=1666555318833230&output=ldjh&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&eid=21062818&vrg=2019091901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190926&iu_parts=3379%2Cars.dart%2Cinformation-technology&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x140&prev_scp=pos%3Dsponsor%26ctx_slot_type%3Dnative_xrail%26ctx_slot_rn%3D0%26m_mv%3DslotNoHistData%26m_gv%3DslotNoHistData%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dnative_xrail_0&eri=1&cust_params=amznbid%3D0%26amznp%3D0%26m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_topic_sc%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_ent_sc%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_ctx_kw_sc%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1569522046&dt=1569522046315&dlt=1569522045603&idt=478&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=786&adks=1840483542&ucis=3&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dssz=66&icsg=563199665504256&mso=262144&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x0&msz=300x140&ga_vid=472596231.1569522046&ga_sid=1569522046&ga_hid=1264286218&fws=516&ohw=300
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
b14cd57235aeef49871807324c598f69d8437551b2cfd135c8dbb404b2e5ff72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2607
x-xss-protection
0
google-lineitem-id
4736014287
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138237302059
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
15 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Mon, 23 Sep 2019 16:57:12 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=65224
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
rules-p-Jjy-Cyr1NZGRz.js
rules.quantcount.com/
4 KB
2 KB
Script
General
Full URL
https://rules.quantcount.com/rules-p-Jjy-Cyr1NZGRz.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:fe00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efdbd8582066a12cf45115f1e150d2a8de06bf6b14db3feca98b116efeb9e0bb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 17:45:47 GMT
content-encoding
gzip
last-modified
Mon, 19 Mar 2018 22:18:17 GMT
server
AmazonS3
age
2108
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=3600
x-amz-cf-pop
FRA56
x-amz-cf-id
7CUMguJ8_a2hByPVwekLovd0v1RUuJh7h8jKel2KmUGnJHiBF8DqOg==
via
1.1 c5ad7defce0694621f07129d852e42da.cloudfront.net (CloudFront)
ijs_all_modules_27b453b1ae67ae0b506ee6950a99e6ac.js
assets.bounceexchange.com/assets/smart-tag/versioned/
347 KB
87 KB
Script
General
Full URL
https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_27b453b1ae67ae0b506ee6950a99e6ac.js
Requested by
Host: tag.bounceexchange.com
URL: https://tag.bounceexchange.com/2806/i.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.98.72.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
0e57eac944064125886efa8d2c1a375b7e50df34923cd900d092bb4a432f3ab3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Sep 2019 13:10:04 GMT
content-encoding
gzip
age
537042
x-guploader-uploadid
AEnB2UovqR7LJUcQRiiu-xPsWq5kM6724V84KjlFWAAeadQ1zVYKZdFq2aSOgmDw1BLwbtXsREPL4lHoQJ9kpE63QYcDZw5muQ
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
88600
last-modified
Fri, 20 Sep 2019 13:09:58 GMT
server
UploadServer
etag
"10a78dc6bc378561fb8c6e95e4327b0f"
vary
Accept-Encoding
x-goog-hash
crc32c=U6kV+g==, md5=EKeNxrw3hWH7jG6V5DJ7Dw==
x-goog-generation
1568984998181974
access-control-allow-origin
*
cache-control
public,max-age=31536000
x-goog-stored-content-length
88600
accept-ranges
bytes
content-type
text/javascript
expires
Sat, 19 Sep 2020 13:10:04 GMT
publisher:getClientId
ampcid.google.de/v1/
3 B
248 B
XHR
General
Full URL
https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
23
x-xss-protection
0
sparrow.min.js
pixel.condenastdigital.com/
38 KB
14 KB
Script
General
Full URL
https://pixel.condenastdigital.com/sparrow.min.js
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.239 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aece3989759ce8b9a715ba342a604316f14a06ff35d5d4ee0cb5c7dfc8bbecc6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Age
527605
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
13266
x-amz-id-2
G22jDR/T8Gn5E/DpiqgzExuok1rN1IkBMU610B7kk+5zBa3VSyC9OSc2tGwSwko2nJI4oLiZ+R8=
X-Served-By
cache-iad2128-IAD, cache-hhn4083-HHN
Access-Control-Allow-Origin
*
Last-Modified
Fri, 26 Jul 2019 15:47:25 GMT
Server
AmazonS3
X-Timer
S1569522046.390103,VS0,VE0
ETag
"dba402ad6593e4f796c1bbad29c3e81e"
Vary
Accept-Encoding
x-amz-request-id
DEC7F0F62070489D
Via
1.1 varnish, 1.1 varnish
Expires
Fri, 26 Jul 2019 21:47:24 GMT
Cache-Control
no-cache, public, max-age=604800
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
1, 8314
dwce_cheq_events
log.outbrainimg.com/loggerServices/
4 B
344 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1569522046388&sessionId=95239b7f-646e-14e0-2968-92e6917f5d92&url=arstechnica.com&cheqSource=1&cheqEvent=0&exitReason=2
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1569522045990
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
X-TraceId
62c7ea44fa2f44f3112ac1278356a8b9
Content-Length
4
Expires
0
arstechnica.com
srv-2019-09-26-18.config.parsely.com/config/
419 B
837 B
Script
General
Full URL
https://srv-2019-09-26-18.config.parsely.com/config/arstechnica.com
Requested by
Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.236.123.155 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-236-123-155.compute-1.amazonaws.com
Software
/ Express
Resource Hash
a1dd63b1924f5c7c67b01fd56d540707e46a4e5a3aae52a526b37d1c041fef61

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Cache-Control
private, no-cache
ETag
W/"1a3-POWwhleayP+/bc8m+AplFg"
Connection
keep-alive
X-Powered-By
Express
Content-Length
419
Content-Type
text/javascript; charset=utf-8
adsct
t.co/i/
43 B
167 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1o49&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
116
pragma
no-cache
last-modified
Thu, 26 Sep 2019 18:20:46 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
28c10d58eda0906eb1c4afbcd4ac2d38
x-transaction
0031c66000ff68b9
expires
Tue, 31 Mar 1981 05:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=43&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatDfpSlotId=_out_of_page_0&zMoatRendered=1&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=1&zMoatPageDataTargetingSet=1&zMoatSafetyTargetingSet=1&zMoatEmptySlot=1&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=886510314&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:46 GMT
inferredEvents.js
connect.facebook.net/signals/plugins/
35 KB
10 KB
Script
General
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id
194532234
pragma
private
x-fb-debug
yQoo2TGdKKLQOiijsUyu7JIT8s3+Jw1ia3AvyuJIMHMuiDQnwl3q/eJa/m5EJ1RNSeIgzIrLMUlLozC7Phul2g==
content-encoding
gzip
x-content-type-options
nosniff
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:46 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
private
vary
Accept-Encoding
content-length
10218
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
i
tr.snapchat.com/cm/ Frame 9B79
0
0
Document
General
Full URL
https://tr.snapchat.com/cm/i?
Requested by
Host: sc-static.net
URL: https://sc-static.net/scevent.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.226.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.17.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
tr.snapchat.com
:scheme
https
:path
/cm/i?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
server
nginx/1.17.3
date
Thu, 26 Sep 2019 18:20:46 GMT
content-type
text/html
content-length
0
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
s65922514969446
sstats.arstechnica.com/b/ss/conde-arstechnica/1/JS-1.4.1-D7QN/
43 B
546 B
Image
General
Full URL
https://sstats.arstechnica.com/b/ss/conde-arstechnica/1/JS-1.4.1-D7QN/s65922514969446?AQB=1&ndh=1&pf=1&t=26%2F8%2F2019%2020%3A20%3A46%204%20-120&D=D%3D&mid=25794962033161343252870198543650218604&aamlh=6&ce=UTF-8&ns=condenast&pageName=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&g=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&c.&visCheck=25794962033161343252870198543650218604&.c&cc=USD&ch=Biz%20%26amp%3B%20IT&events=event2%2Cevent28&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v2=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&l2=android-malware%7Cgoogle-play%7Cmalvertising%7Csymantec%7Ctype%3A%20report&c3=D%3Dv3&v3=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&c4=D%3Dv4&v4=1575179&c5=D%3Dv5&v5=report&c6=D%3Dv6&v6=Biz%20%26amp%3B%20IT&c7=D%3Dv7&v7=Biz%20%26amp%3B%20IT%2Fundefined&c11=D%3Dv11&v11=2%3A20%20PM%7CThursday&c16=not%20logged%20in&v16=not%20logged%20in&c17=1&v17=1&c23=D%3Dv23&v23=New&c32=D%3Dv32&v32=1&c44=D%3Dv44&v44=null&c50=android-malware%7Cgoogle-play%7Cmalvertising%7Csymantec%7Ctype%3A%20report&c51=D%3Dv51&v51=desktop%20layout%3A1600x1200&c55=D%3Dv55&v55=Sean%20Gallagher&c56=D%3Dv56&v56=1.3&c60=D%3Dv60&v60=467&c61=D%3Dv61&v61=3h%7C0d&c62=D%3Dv62&v62=2019-09-26T14%3A41%3A10%2B00%3A00&c65=D%3Dv65&v65=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.41.50 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
arstechnica.com.ssl.d1.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
X-C
ms-6.10.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 27 Sep 2019 18:20:46 GMT
Server
Omniture DC
xserver
www7157
ETag
"3370522929047601152-5089385971833657993"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Wed, 25 Sep 2019 18:20:46 GMT
collect
www.google-analytics.com/
35 B
119 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&gjid=1725691387&_gid=1254782137.1569522046&_u=aChAgUAjAAQC~&z=1320917498
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498&slf_rd=1&random=2752521179
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498&slf_rd=1&random=2752521179
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=472596231.1569522046&jid=1429065645&_v=j79&z=1320917498&slf_rd=1&random=2752521179
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7076
0
63 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssOpFBp_WqwFBxRWDlKkJ1pIKHG5Lfju0AHOe1vs8wSmSeYKon-2WDngmrfx6c0WBm1WPFmcas32sy4Jrm8hzXHU8W85qwfwBdpSEftsowijUWKjEpTKRWYAtzoIBRPqUDW4TKUU_eRi-d3nZDeZHDL8hvHfAcLETfZLOT8sVUot9gIFIO1i9FpE5OmrSRxAVfcHlBZFGCTTD8ySyydO5sp25JIz8JW7HTOMTKsbwQj25ZqxqIgLHX242qlOhNZqhi0_HzQLXOq9sYK0bsMzd4y4C2j&sig=Cg0ArKJSzP3fr5omvCjdEAE&urlfix=1&adurl=
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
creative.js
static.polarcdn.com/creative/ Frame 7076
310 KB
118 KB
Script
General
Full URL
https://static.polarcdn.com/creative/creative.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:f87e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d60f8e6be6d438948ca73aa671c90cb06c1f922637f7b1b6e83d5dd2fa02bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
cf-cache-status
HIT
age
2583
cf-ray
51c740f6ce6f8c80-VIE
status
200
cf-ipcountry
DE
content-type
application/javascript
content-length
120010
access-control-allow-origin
*
last-modified
Wed, 18 Sep 2019 19:34:33 GMT
server
cloudflare
etag
W/"5d8286c9-4d966"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
x-varnish
478964912 478952999
via
1.1 varnish
access-control-expose-headers
CF-IPCountry
cache-control
max-age=10800
access-control-allow-credentials
true
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Thu, 26 Sep 2019 19:35:59 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 7076
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6182dfae0694d2f06ce0ba9e18b21af30bdc62b4878767761059e6f03cba08e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569237451959804"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
29692
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:46 GMT
moatad.js
z.moatads.com/condenastdfp9588492144/ Frame 7076
297 KB
99 KB
Script
General
Full URL
https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
0018ca8c16b5f2b4a5b90fbdf2a7f9efe679564ecbc13b37fdbc73f44118606f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:35:01 GMT
Server
AmazonS3
x-amz-request-id
639B29FE24B49EB3
ETag
"2d31e9923188682b1c63d504e9908fc1"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=54945
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
100930
x-amz-id-2
HIs4QpCnBui/IprT2fzBJH0sNycsABuS/+9xV1xEGoOlhbLT2VcAQGFedHbIqEXmz2ORmBAMl9w=
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
218087ed3854e672a6627b47c86b3a97e1dad722daa9f509fe522b33b01302a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569237451959804"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
29169
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:46 GMT
p-Jjy-Cyr1NZGRz.gif
pixel.quantserve.com/pixel/
35 B
494 B
Image
General
Full URL
https://pixel.quantserve.com/pixel/p-Jjy-Cyr1NZGRz.gif?labels=_campaign.media.Advertiser%20ID.1454517775.Campaign%20ID.2338761482.Line%20Item%20ID.4736014287
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.189 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
QS
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
/
infinityid.condenastdigital.com/
36 B
1 KB
XHR
General
Full URL
https://infinityid.condenastdigital.com/?rand=1569522046468
Requested by
Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.222.12 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-22-222-12.compute-1.amazonaws.com
Software
nginx/1.15.8 /
Resource Hash
5ab61c8d78ed26c8e63180889524a5bc6112f235470923b7cff8fab807cca98b

Request headers

Accept
text/plain
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
Server
nginx/1.15.8
vary
origin,accept-encoding
Content-Type
text/plain; charset=utf-8
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
access-control-allow-credentials
true
Connection
keep-alive
transfer-encoding
chunked
content
4d.condenastdigital.com/
4 KB
2 KB
XHR
General
Full URL
https://4d.condenastdigital.com/content?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
Requested by
Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.209.40.151 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-209-40-151.compute-1.amazonaws.com
Software
/
Resource Hash
ee9bf356f3439eed2f173cb63dd4e0d35a4d298bbd706828ebcea8f61647d883

Request headers

Accept
text/plain
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
Content-Type
application/json; charset=utf-8
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
Connection
keep-alive
Content-Length
1284
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A46.469Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3400&pSw=1600&pSh=1200&uID=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&uNw=1&uUq=1&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22_out_of_page_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Atrue%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22out_of_page_0%22%2C%22outOfPage%22%3Atrue%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%221x1%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522046369%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22interstitial%22%5D%2C%22ctx_slot_type%22%3A%5B%22out_of_page%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22out_of_page_0%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%7D
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A46.476Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3400&pSw=1600&pSh=1200&uID=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fars.dart%2Finformation-technology%22%2C%22advertiserId%22%3A1454517775%2C%22campaignId%22%3A2338761482%2C%22creativeId%22%3A138237302059%2C%22elementId%22%3A%22native_xrail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4736014287%2C%22name%22%3A%22native_xrail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x140%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522046462%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22sponsor%22%5D%2C%22ctx_slot_type%22%3A%5B%22native_xrail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22native_xrail_0%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22_EdmH3jRTlez_%22%5D%7D
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
/
polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/ Frame 34CD
0
0
Document
General
Full URL
https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Requested by
Host: plugin.mediavoice.com
URL: https://plugin.mediavoice.com/plugin.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
polarcdn-terrax.com
:scheme
https
:path
/privacy/v1.0.0/html/optout/readwrite/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

status
200
date
Thu, 26 Sep 2019 18:20:46 GMT
content-type
text/html; charset=utf-8
content-length
1242
set-cookie
__cfduid=dd0dcb906879011650d0bb9f56c8409031569522046; expires=Fri, 25-Sep-20 18:20:46 GMT; path=/; domain=.polarcdn-terrax.com; HttpOnly
vary
Accept-Encoding
access-control-allow-headers
Authorization
access-control-expose-headers
CF-IPCountry, X-Country, CF-Ray
cache-control
max-age=900
access-control-allow-origin
*
access-control-allow-methods
GET
timing-allow-origin
*
content-encoding
gzip
x-varnish
1609394112 1609379826
via
1.1 varnish
cf-cache-status
HIT
age
648
accept-ranges
bytes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
51c740f6dbcdcbc4-VIE
bid
c.amazon-adsystem.com/e/dtb/
46 B
392 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=3035&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pid=1776350654041569522045679&cb=157538919081569522046513&ws=1600x1200&v=7.36.02&t=1000&slots=%5B%7B%22sd%22%3A%22siderail_0%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%7D%2C%7B%22sd%22%3A%22post_nav_0%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%7D%5D&pj=%7B%22si_section%22%3A%22information-technology%22%2C%22apse%22%3A%7B%22chunkRequests%22%3Afalse%2C%22shouldCFRoute%22%3Atrue%2C%22shouldSampleLatency%22%3Afalse%7D%7D&cfgv=0&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.211.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-211-231.fra53.r.cloudfront.net
Software
Server /
Resource Hash
d61567f55aced52701dab97ae40d4caf75d81c92b51932a03de88020666dc31e

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 ab39b007ab81966ada6e7fb1536bf377.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA53-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://arstechnica.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
46
x-amz-cf-id
t71t72rbu7oa_-9_Ojq3EsPmG666-Pf3DrwZpc6lQDYSJNP2bpULTA==
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=43&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatDfpSlotId=native_xrail_0&zMoatRendered=2&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=2&zMoatPageDataTargetingSet=2&zMoatSafetyTargetingSet=2&zMoatEmptySlot=1&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=1971662223&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:46 GMT
5b27ee7e8c1abc4e7900000f
api.cnevids.com/v1/video_groups/
44 KB
8 KB
XHR
General
Full URL
https://api.cnevids.com/v1/video_groups/5b27ee7e8c1abc4e7900000f?endpoint=oo.arstechnica
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-639c20175b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.155.118 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-230-155-118.compute-1.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
ca2a9c9b370cb90986b0dd715198e0b4445eea0ca984f520fb988d00b1de6976
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/*
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Status
200 OK
Access-Control-Max-Age
1728000
Connection
keep-alive
Content-Length
7336
X-XSS-Protection
1; mode=block
X-Request-Id
396fa4ea-b672-4ee1-9ba4-56155bead84f
X-Runtime
0.003019
X-Backend-Node
10.110.44.187
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx/1.14.1
X-Frame-Options
SAMEORIGIN
ETag
W/"85a4ccdf28754d723455fda5034295e3"
X-Download-Options
noopen
Vary
Accept-Encoding, Origin
Access-Control-Allow-Methods
GET, PUT, POST, DELETE, OPTIONS
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Cache-Control
max-age=0, private, must-revalidate
/
www.facebook.com/tr/
44 B
247 B
Image
General
Full URL
https://www.facebook.com/tr/?id=228464857488266&ev=PageView&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&rl=&if=false&ts=1569522046540&cd[SiteSection]=information%20technology&cd[PageTags]=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cd[Brand]=Pitchfork&sw=1600&sh=1200&v=2.9.4&r=stable&ec=0&o=30&fbp=fb.1.1569522046539.1863294199&it=1569522046290&coo=false&rqm=GET
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Thu, 26 Sep 2019 18:20:46 GMT
local_storage_frame10.min.html
assets.bounceexchange.com/assets/bounce/ Frame E173
0
0
Document
General
Full URL
https://assets.bounceexchange.com/assets/bounce/local_storage_frame10.min.html
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_27b453b1ae67ae0b506ee6950a99e6ac.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.98.72.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

:method
GET
:authority
assets.bounceexchange.com
:scheme
https
:path
/assets/bounce/local_storage_frame10.min.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
x-guploader-uploadid
AEnB2Ur311uTHEJjWzYFjysY2-sQWyPZ4Z-AX_c7MEv3L-Tw0_FpQDaDqZ00UWcsuIXiAWZwwGtAOopsEd2qlqVMOgHpL5gqyA
date
Tue, 17 Sep 2019 16:12:17 GMT
expires
Wed, 16 Sep 2020 16:12:17 GMT
last-modified
Thu, 25 Jul 2019 15:10:57 GMT
etag
"55fccc7bc73db2181e976f1ccec90e2c"
x-goog-generation
1564067457180148
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
x-goog-stored-content-length
995
content-type
text/html
content-encoding
gzip
x-goog-hash
crc32c=z+risA== md5=VfzMe8c9shgel28czskOLA==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
vary
Accept-Encoding
content-length
995
access-control-allow-origin
*
server
UploadServer
cache-control
public, max-age=31536000
age
785309
alt-svc
clear
p
tr.snapchat.com/ Frame 7C2B
0
0
Document
General
Full URL
https://tr.snapchat.com/p
Requested by
Host: sc-static.net
URL: https://sc-static.net/scevent.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.226.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.17.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
tr.snapchat.com
:scheme
https
:path
/p
content-length
406
pragma
no-cache
cache-control
no-cache
origin
https://arstechnica.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
Origin
https://arstechnica.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
server
nginx/1.17.3
date
Thu, 26 Sep 2019 18:20:46 GMT
content-type
text/html
content-length
0
access-control-allow-origin
*
cache-control
no-cache, no-transform
set-cookie
sc_at=v2|H4sIAAAAAAAAAAXBgQ0AIAgDsItIYM6J54jxC463HTf5lh+rtZ+RJStEGBQJVApid0ztCTjV/gEvFHo1MgAAAA==;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
publishertag.js
static.criteo.net/js/ld/
87 KB
27 KB
Script
General
Full URL
https://static.criteo.net/js/ld/publishertag.js
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
28567b9298df1914ea63e0ea93676032cdb92854a9fb100a29a4890230a9ca90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
last-modified
Tue, 24 Sep 2019 18:17:48 GMT
server
nginx
etag
W/"5d8a5dcc-15bb7"
transfer-encoding
chunked
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
timing-allow-origin
*
expires
Fri, 27 Sep 2019 18:20:46 GMT
rid
match.adsrvr.org/track/
109 B
536 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183973
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.88.219 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-76-88-219.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
590ea82ecaec9d3178c7123d813a9e2f9a3406001224687585096d6c00f6c57e

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://arstechnica.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Sat, 26 Oct 2019 18:20:46 GMT
identity
api.rlcdn.com/api/
0
0

ids
mid.rkdms.com/
0
0

/
polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/ Frame 8434
0
0
Document
General
Full URL
https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
polarcdn-terrax.com
:scheme
https
:path
/privacy/v1.0.0/html/optout/readwrite/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
accept-encoding
gzip, deflate, br
cookie
__cfduid=dd0dcb906879011650d0bb9f56c8409031569522046
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

status
200
date
Thu, 26 Sep 2019 18:20:46 GMT
content-type
text/html; charset=utf-8
content-length
1242
vary
Accept-Encoding
access-control-allow-headers
Authorization
access-control-expose-headers
CF-IPCountry, X-Country, CF-Ray
cache-control
max-age=900
access-control-allow-origin
*
access-control-allow-methods
GET
timing-allow-origin
*
content-encoding
gzip
x-varnish
1609394112 1609379826
via
1.1 varnish
cf-cache-status
HIT
age
648
accept-ranges
bytes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
51c740f7aeaccbc4-VIE
wt
polarcdn-pentos.com/ Frame 7076
3 B
596 B
XHR
General
Full URL
https://polarcdn-pentos.com/wt?e=1&n=3&p=UNKNOWN&s=1&u=42d911ae-59b8-49f4-a4cd-c87b5a1fd621&v=2%2Fbd213b0&w=1.158.0&y=w&z=v1.6.48&pas=asa-web&pag2=%2F3379%2Fars.dart&pai=e55f9&d=arstechnica.com&l=&pajs=&pepm=gdpr-eu&pepc=n&mepc=1&pasf=0&paio=1&pasb=1&cu=835ad2a8b2616bc19965dab731d444a2&t=arx&parcid=b11d7&parid=7bc03&parin=1&partm=0&par=s&maxts=0.01&pvhref=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_=1569522046647
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.78 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f0e2d95e318789b840f67b7004cb30985ce2e0ef3ece7507b2b15e8441811a7

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
258233
cf-ray
51c740f8e966d6ed-FRA
status
200
content-length
3
x-amz-id-2
fdX907fwNt8pr3tw3gr73uFQXky3viGiZTMtdYbPcadu4V04bAegc8VyKwcCSRJX1hpdYoYX62c=
last-modified
Mon, 09 Jul 2018 17:31:51 GMT
server
cloudflare
etag
"28e4477bb454eb35226fe56082545e13"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
access-control-allow-methods
GET
x-amz-request-id
E1FE302C79362616
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
application/octet-stream
wt
polarcdn-pentos.com/ Frame 7076
3 B
66 B
XHR
General
Full URL
https://polarcdn-pentos.com/wt?e=2&n=3&p=UNKNOWN&s=1&u=42d911ae-59b8-49f4-a4cd-c87b5a1fd621&v=2%2Fbd213b0&w=1.158.0&y=w&z=v1.6.48&pas=asa-web-polarpmp&pag1=conde_customcontent_market&pag2=brand_arstechnica&paenb=y&pai=e55f9&d=arstechnica.com&l=&pajs=&pepm=gdpr-eu&pepc=n&mepc=1&pasf=0&paio=1&pasb=1&cu=835ad2a8b2616bc19965dab731d444a2&t=atx&parcid=b11d7&parid=d7f7a&parin=2&pvhref=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_=1569522046648
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.78 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f0e2d95e318789b840f67b7004cb30985ce2e0ef3ece7507b2b15e8441811a7

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
258233
cf-ray
51c740f8e96ed6ed-FRA
status
200
content-length
3
x-amz-id-2
fdX907fwNt8pr3tw3gr73uFQXky3viGiZTMtdYbPcadu4V04bAegc8VyKwcCSRJX1hpdYoYX62c=
last-modified
Mon, 09 Jul 2018 17:31:51 GMT
server
cloudflare
etag
"28e4477bb454eb35226fe56082545e13"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
access-control-allow-methods
GET
x-amz-request-id
E1FE302C79362616
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
application/octet-stream
req
bw-prod.plrsrvcs.com/ Frame 7076
2 KB
3 KB
XHR
General
Full URL
https://bw-prod.plrsrvcs.com/req
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:dc0f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a7d1a4075cbd1121f65a26404cfc3c8534ed2cee39395695b0125f9381e560f

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
x-openrtb-version
2.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/json

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 google
x-polar-trace-id
x-polar-response-id
7363d84f33194727a66c2589311635f0
status
200
cf-ipcountry
DE
x-polar-h
7b1a4-12
x-polar-t
0.012
content-encoding
gzip
alt-svc
clear
pragma
no-cache
server
cloudflare
x-polar-misses
tq
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CF-IPCountry
cache-control
no-cache, no-store, must-revalidate
cf-ray
51c740f85c8bcbac-VIE
expires
0
Cookie set /
www.medtargetsystem.com/beacon/portal/ Frame 7668
0
0
Document
General
Full URL
https://www.medtargetsystem.com/beacon/portal/?_url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_sid=f2f97105-bc19-4d18-b463-188d09348b68&_vid=02e0eaf8-8c09-43fd-93c1-df359557623d&_ak=119-556-B0E9F642&_flash=false&_th=1569522046|1569522046|1
Requested by
Host: www.medtargetsystem.com
URL: https://www.medtargetsystem.com/javascript/beacon.js?v2.5.12
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.219.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-219-33.compute-1.amazonaws.com
Software
Apache/2.4.7 (Ubuntu) / PHP/7.0.19-1+deb.sury.org~trusty+2
Resource Hash

Request headers

Host
www.medtargetsystem.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 26 Sep 2019 18:20:46 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Pragma
no-cache
Server
Apache/2.4.7 (Ubuntu)
Set-Cookie
DMDSESSID=687f5tdmhqshf2c8knhbb859i6; path=/; HttpOnly
Vary
X-Forwarded-Proto,Accept-Encoding
X-Powered-By
PHP/7.0.19-1+deb.sury.org~trusty+2
Content-Length
6989
Connection
keep-alive
collect.gif
www.medtargetsystem.com/analytics/
0
313 B
Image
General
Full URL
https://www.medtargetsystem.com/analytics/collect.gif?e=1&aid=&vid=02e0eaf8-8c09-43fd-93c1-df359557623d&sid=f2f97105-bc19-4d18-b463-188d09348b68&vh=1&vt=1569522046&pt=1569522046&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&r=&t=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users%20%7C%20Ars%20Technica&p=2209.41&pm=&ab=&ak=119-556-B0E9F642
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.219.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-219-33.compute-1.amazonaws.com
Software
Apache/2.4.7 (Ubuntu) / PHP/7.0.19-1+deb.sury.org~trusty+2
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
Apache/2.4.7 (Ubuntu)
Connection
keep-alive
X-Powered-By
PHP/7.0.19-1+deb.sury.org~trusty+2
Content-Length
0
Vary
X-Forwarded-Proto
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 7076
210 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03ac3d036036cbf3c6fac48afb6bcdde869969afbc1668e9ef5e12a35f75e512

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
ADTECH;apid=1A5c39d52a-e08a-11e9-865e-12ddab465c88;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks....
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A5c39d52a-e08a-11e9-865e-12ddab465c88;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=...
103 B
159 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A5c39d52a-e08a-11e9-865e-12ddab465c88;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.22.24 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
e0923229dc6c526b6f051474659888a7f7d0abcade19683559ac10e44df1c816

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
text/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
103
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A5c39d52a-e08a-11e9-865e-12ddab465c88;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046721;callback=window.headertag.AolHtb.adResponseCallbacks._rhMfDOA6
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks....
104 B
137 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.22.24 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
42bdeafb737422f24e47f276e1f9b234c68cd6bcf8af8f7dc690cc350d1e4e08

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
text/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
104
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046722;callback=window.headertag.AolHtb.adResponseCallbacks._LseOCB3q
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=15&p_pos=btf&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1070068&kw=rp.fastlane&tk_flint=index&rand=0.058598878891090944&alt_size_ids=10
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
f6df0547927db498a5d72c147e36233ee9d46d5264066aeda29c1c467b77a186

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=170
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
cygnus
as-sec.casalemedia.com/
16 KB
11 KB
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A80632263%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2233%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2231%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2221d83b07-7ac2-4f9b-917b-72c95b99b35c%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-09-26T18%3A20%3A46%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
079a0f28b3d0c3b61c60636496178eec4da6da2a7289540c69c15171a235fb84

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
10801
Expires
Thu, 26 Sep 2019 18:20:46 GMT
cygnus
as-sec.casalemedia.com/
66 B
938 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A76356383%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%227%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%228%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2221d83b07-7ac2-4f9b-917b-72c95b99b35c%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-09-26T18%3A20%3A46%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5a33ef24aeb697d2d597a863185f7013b37fd040893d4fb85a45282fa929ccff

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Thu, 26 Sep 2019 18:20:46 GMT
ADTECH;apid=1A5c39456a-e08a-11e9-a3d4-1215cb940d7a;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks....
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A5c39456a-e08a-11e9-a3d4-1215cb940d7a;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=...
104 B
161 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A5c39456a-e08a-11e9-a3d4-1215cb940d7a;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.22.24 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
f39ddd205229b1de9d44fdda230c861a2a7c8eb3a7755772804eff7f93ee7796

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
text/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
104
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A5c39456a-e08a-11e9-a3d4-1215cb940d7a;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._GLTYGprY
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A5c39c6ac-e08a-11e9-b7d5-12795fd23bd8;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1569522045;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks....
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A5c39c6ac-e08a-11e9-b7d5-12795fd23bd8;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=...
104 B
137 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A5c39c6ac-e08a-11e9-b7d5-12795fd23bd8;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.22.24 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
e605a40726f8df92ab07cd4c781f8299d077c373f5d5a3488e18ae842493c1cb

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
text/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
104
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A5c39c6ac-e08a-11e9-b7d5-12795fd23bd8;cfp=1;rndc=1569522046;cmd=bid;cors=yes;v=2;misc=1569522046724;callback=window.headertag.AolHtb.adResponseCallbacks._e75CrF9j
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
256 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=2&p_pos=btf&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1070068&kw=rp.fastlane&tk_flint=index&rand=0.6789227564395406&alt_size_ids=57
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
10db660a624f80771a66d913adc64a1a5c992546fb5e04e8905d0fd31d7a5ff3

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=450
Content-Length
256
Expires
Wed, 17 Sep 1975 21:32:10 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A46.773Z&_t=slot_loaded&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3400&pSw=1600&pSh=1200&uID=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fars.dart%2Finformation-technology%22%2C%22advertiserId%22%3A1454517775%2C%22campaignId%22%3A2338761482%2C%22creativeId%22%3A138237302059%2C%22elementId%22%3A%22native_xrail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Atrue%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4736014287%2C%22name%22%3A%22native_xrail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x140%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522046462%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1569522046772%7D&dim4=%7B%22pos%22%3A%5B%22sponsor%22%5D%2C%22ctx_slot_type%22%3A%5B%22native_xrail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22native_xrail_0%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22_EdmH3jRTlez_%22%5D%7D
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:46 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
optanon.css
optanon.blob.core.windows.net/skins/5.2.0/default_flat_bottom_two_button_black/v2/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://optanon.blob.core.windows.net/skins/5.2.0/default_flat_bottom_two_button_black/v2/css/optanon.css
Requested by
Host: optanon.blob.core.windows.net
URL: https://optanon.blob.core.windows.net/consent/c941cf3b-dfcd-475f-90e4-e7f422fc89dd.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Thu, 26 Sep 2019 18:20:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 20:24:48 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
jzLE25vmrDR3ZmMxTSa8+w==
ETag
0x8D73D3F6B302F72
Content-Type
text/css
Access-Control-Allow-Origin
*
x-ms-request-id
5779dc3d-001e-0116-1f97-745f2d000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
5556
jquery-3.3.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: optanon.blob.core.windows.net
URL: https://optanon.blob.core.windows.net/consent/c941cf3b-dfcd-475f-90e4-e7f422fc89dd.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
Last-Modified
Sat, 20 Jan 2018 17:26:44 GMT
Server
nginx
ETag
W/"5a637bd4-1538f"
Vary
Accept-Encoding
X-HW
1569522046.dop008.fr8.shc,1569522046.dop008.fr8.t,1569522046.cds057.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
30288
57
p.ad.gt/api/v1/p/
23 KB
8 KB
Script
General
Full URL
https://p.ad.gt/api/v1/p/57
Requested by
Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/57
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.10.35.234 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-10-35-234.us-west-2.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
3ad61829a2c11519967b8d9e7e243c27e04322551b6ae37bd0c90683ab3c11a0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
last-modified
Wed, 18 Sep 2019 02:43:10 GMT
server
nginx/1.14.1
etag
W/"1568774590.0-23817-2545748540"
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
public, max-age=43200
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
expires
Fri, 27 Sep 2019 06:20:47 GMT
match
ids.ad.gt/api/v1/
Redirect Chain
  • https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=$UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3Def86d117-724c-4cea-a262-6d0d725e61f2%26adnxs_id%3D%24UID
  • https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=8030735307538656780
43 B
597 B
Image
General
Full URL
https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=8030735307538656780
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
transfer-encoding
chunked
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:48 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80
AN-X-Request-Uuid
9c987d6b-8f46-49de-ab55-adfc647fb180
Server
nginx/1.13.4
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ids.ad.gt/api/v1/match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&adnxs_id=8030735307538656780
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
t_match
ids.ad.gt/api/v1/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=ef86d117-724c-4cea-a262-6d0d725e61f2
  • https://ids.ad.gt/api/v1/t_match?tdid=21d83b07-7ac2-4f9b-917b-72c95b99b35c&id=ef86d117-724c-4cea-a262-6d0d725e61f2
43 B
588 B
Image
General
Full URL
https://ids.ad.gt/api/v1/t_match?tdid=21d83b07-7ac2-4f9b-917b-72c95b99b35c&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
x-aspnet-version
4.0.30319
status
302
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ids.ad.gt/api/v1/t_match?tdid=21d83b07-7ac2-4f9b-917b-72c95b99b35c&id=ef86d117-724c-4cea-a262-6d0d725e61f2
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
259
pbm_match
ids.ad.gt/api/v1/
Redirect Chain
  • https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3Def86d117-724c-4cea-a262-6d0d725e61f2
  • https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3Def86d117-724c-4cea-a262-6d0d725e61f2
  • https://ids.ad.gt/api/v1/pbm_match?pbm=14DC5BB2-B855-4DDE-8021-68BDF852E977&id=ef86d117-724c-4cea-a262-6d0d725e61f2
43 B
588 B
Image
General
Full URL
https://ids.ad.gt/api/v1/pbm_match?pbm=14DC5BB2-B855-4DDE-8021-68BDF852E977&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://ids.ad.gt/api/v1/pbm_match?pbm=14DC5BB2-B855-4DDE-8021-68BDF852E977&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Date
Thu, 26 Sep 2019 18:20:46 GMT
X-Cnection
close
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Content-Length
439
Content-Type
text/html; charset=iso-8859-1
g_match
ids.ad.gt/api/v1/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=ef86d117-724c-4cea-a262-6d0d725e61f2
  • https://ids.ad.gt/api/v1/g_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&google_gid=CAESEFbJ9vE1WNrbBmY5TUuzpEE&google_cver=1&google_ula=450542624,0
43 B
586 B
Image
General
Full URL
https://ids.ad.gt/api/v1/g_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&google_gid=CAESEFbJ9vE1WNrbBmY5TUuzpEE&google_cver=1&google_ula=450542624,0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:46 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ids.ad.gt/api/v1/g_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&google_gid=CAESEFbJ9vE1WNrbBmY5TUuzpEE&google_cver=1&google_ula=450542624,0
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
357
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
son_match
ids.ad.gt/api/v1/
Redirect Chain
  • https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=[UID]
  • https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=46168c59-7b6c-4cdd-8c22-63d25fe58770
43 B
588 B
Image
General
Full URL
https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=46168c59-7b6c-4cdd-8c22-63d25fe58770
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:46 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ids.ad.gt/api/v1/son_match?id=ef86d117-724c-4cea-a262-6d0d725e61f2&uid=46168c59-7b6c-4cdd-8c22-63d25fe58770
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
adb_match
ids.ad.gt/api/v1/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=348447&dpuuid=ef86d117-724c-4cea-a262-6d0d725e61f2&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3Def86d117-724c-4cea-a262-6d0d7...
  • https://ids.ad.gt/api/v1/adb_match?adb=25585191066055673402853426108189879989&id=ef86d117-724c-4cea-a262-6d0d725e61f2
43 B
609 B
Image
General
Full URL
https://ids.ad.gt/api/v1/adb_match?adb=25585191066055673402853426108189879989&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:47 GMT
Server
nginx/1.8.1
Connection
keep-alive
transfer-encoding
chunked
Content-Type
image/gif

Redirect headers

Pragma
no-cache
X-TID
gi4yuVahS5Y=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://ids.ad.gt/api/v1/adb_match?adb=25585191066055673402853426108189879989&id=ef86d117-724c-4cea-a262-6d0d725e61f2
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ptrack-v1.3.1-engagedtime-slots.js
d1z2jf7jlzjs58.cloudfront.net/code/
39 KB
16 KB
Script
General
Full URL
https://d1z2jf7jlzjs58.cloudfront.net/code/ptrack-v1.3.1-engagedtime-slots.js
Requested by
Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-228.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
0c0e9dc8fec253f7362e4615301635f8ab97e7c426dcd298f9afa1f01d290c57

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 07 Jun 2019 23:31:30 GMT
Content-Encoding
gzip
Age
9571750
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Fri, 07 Jun 2019 23:29:12 GMT
Server
nginx
ETag
W/"5cfaf348-9cdb"
Content-Type
application/x-javascript
Via
1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
Cache-Control
max-age=315360000, public
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
KlJ6U3dgsC3Wl5hmpEV7g1QO94CSo8Icg6dG265QmMhrZbnpovyWJA==
Expires
Thu, 31 Dec 2037 23:55:55 GMT
5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
player.cnevids.com/script/video/
63 KB
21 KB
Script
General
Full URL
https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-639c20175b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.13 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-13.fra53.r.cloudfront.net
Software
nginx/1.14.1 /
Resource Hash
e90e89e353e425b78e1e852b73984818459e4e31482bb38a25cbc00d624d4f06
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:46 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
X-Amz-Cf-Pop
FRA53-C1
X-Cache
Miss from cloudfront
Status
200 OK
Connection
keep-alive
Content-Length
20627
X-XSS-Protection
1; mode=block
X-Request-Id
094584fb-e392-421c-9b4c-7105029a5c5c
X-Runtime
0.078786
X-Backend-Node
10.110.29.24
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx/1.14.1
ETag
W/"79a6aec37841530228183aef97906e42"
X-Download-Options
noopen
Vary
Origin,Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 d16428714e022976873ccc980fdc1289.cloudfront.net (CloudFront)
Cache-Control
max-age=0, private, must-revalidate
X-Amz-Cf-Id
RhDVyvPKARP0pJpp7oQQVXhW_GWsgVhjsWCueq2r4c9g82Apd7Yrnw==
arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/
16 KB
17 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/arstechnica_war-stories-civilization.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Sep 2019 16:37:49 GMT
Via
1.1 varnish, 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
Age
265377
Edge-Cache-Tag
390602458176548494884398897259766670181,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
16236
X-Request-Id
df2afd02bed526ce
X-Served-By
cache-hhn4065-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Mon, 23 Sep 2019 11:27:54 GMT
Server
cloudinary
X-Timer
S1569256670.782884,VS0,VE192
ETag
"72002610618f7bf8bf0e52c760e39897"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
xYvgb_vgBAFatwj5IYMagF2h83ec-_0-vqhodfqoLW4KUeB0FQwW3g==
X-Cache-Hits
0
arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/
11 KB
11 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 19:55:23 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
771924
Edge-Cache-Tag
285695674967648002297586464606017083075,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
10793
X-Served-By
cache-fra19156-FRA
Last-Modified
Tue, 17 Sep 2019 19:55:15 GMT
Server
cloudinary
X-Timer
S1568750123.147762,VS0,VE109
ETag
"0e1ff58ccf6d97759de3d774a7ff835a"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
Ws5Gq_mwrKw8gFlD39bj_QaYgkyn8hSMcw86dHNTcMNrV38oe_G5Qg==
X-Cache-Hits
0
arstechnica_dead-cells-how-to-avoid-falling-to-your-death-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1563202921/
16 KB
17 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1563202921/arstechnica_dead-cells-how-to-avoid-falling-to-your-death-war-stories.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
5f760e6eaa1fd8e199a7135ae74692369612ff5de37b99eb63bcb8ee7d615568

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 19 Jul 2019 15:13:14 GMT
Via
1.1 varnish, 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
Age
788825
Edge-Cache-Tag
512786565011436188602690990842551442357,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
16016
X-Request-Id
558da5101eeb1f1f
X-Served-By
cache-fra19150-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Fri, 19 Jul 2019 15:13:07 GMT
Server
cloudinary
X-Timer
S1563549194.385414,VS0,VE180
ETag
"4dba8e36b73a44cca8375175ae0e4b39"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
JVRwYl6C_6Mpu7WWhIt-x1DKrICoLdYsR5IFYZSLNOKULz17Shlbow==
X-Cache-Hits
0
arstechnica_warframe-reviews.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/
14 KB
15 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/arstechnica_warframe-reviews.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 27 Jun 2019 19:35:11 GMT
Via
1.1 varnish, 1.1 61adf71a363fe0f836dc69dbb43de824.cloudfront.net (CloudFront)
Age
81502
Edge-Cache-Tag
409825722100045817936218917770258862228,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
14837
X-Request-Id
b6ad3868f2bf03bf
X-Served-By
cache-hhn4083-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Thu, 27 Jun 2019 19:34:59 GMT
Server
cloudinary
X-Timer
S1561664111.929725,VS0,VE147
ETag
"1d90d6aef7585f963e1270a1a02a4dd4"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
3-d_mcM4O-vmh-mFk03esmD_7ZPF3spk41ink06DKGEVoVAoJ_E8oQ==
X-Cache-Hits
0
arstechnica_war-stories-subnautica.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/
15 KB
16 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/arstechnica_war-stories-subnautica.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 05 Jun 2019 17:40:01 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
1376784
Edge-Cache-Tag
384957005148579205807938476483146982592,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
15222
X-Request-Id
0958d581a409116b
X-Served-By
cache-fra19136-FRA
Server
cloudinary
X-Timer
S1559756401.882584,VS0,VE537
ETag
"8c45b6c645caba59f4b14d3fbdc09062"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
lHmMwPab-Ny2HNnuNbYi-BBodTRbN5kLXP2qq7JfQ2FXJwhZZPjynw==
X-Cache-Hits
0
arstechnica_this-war-of-mine-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559075831/
16 KB
16 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559075831/arstechnica_this-war-of-mine-war-stories.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
ec84902ae04cc118d965c577e2ece816abd594431ce66bcef1afd4f745e951fd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 03 Jun 2019 18:11:08 GMT
Via
1.1 varnish, 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
Age
805974
Edge-Cache-Tag
580474366038461196493179311799260666459,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
15985
X-Request-Id
c8c7238dbb15b70b
X-Served-By
cache-hhn1542-HHN
Last-Modified
Mon, 03 Jun 2019 18:11:08 GMT
Server
cloudinary
X-Timer
S1559585468.501454,VS0,VE505
ETag
"42bc7816573b81a73647b6f7123944c5"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
1bWr_iueHHH3s3KjqKWCYVxYzQEiGMWeSoJsbqpUyqMBbQHeVhkFwg==
X-Cache-Hits
0
arstechnica_obra-dinn-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1558373184/
15 KB
16 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1558373184/arstechnica_obra-dinn-war-stories.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
8574074952616e0a56e5b72d9634bff0a683d658d09804c10324293811606d22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 28 May 2019 17:37:15 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
675684
Edge-Cache-Tag
433557846635605494688582207268998106147,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
15609
X-Request-Id
c8a15984885b6e84
X-Served-By
cache-fra19142-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Tue, 28 May 2019 17:36:10 GMT
Server
cloudinary
X-Timer
S1559065035.044774,VS0,VE231
ETag
"8becb0d5f4f7ff3e76e89c89871f465d"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
bdta8Xc59pNttd-0MChjP-FhzItxhYABdncNg9Spk2QYMEq8m5TnHw==
X-Cache-Hits
0
arstechnica_army-s-new-pistol-has-had-some-misfires.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556912500/
8 KB
9 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556912500/arstechnica_army-s-new-pistol-has-had-some-misfires.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
a91d62b47f02a7e638d1749e3791ac328b2dd89dac630578f76e65b1ed91ed89

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 02 Jun 2019 00:09:44 GMT
Via
1.1 varnish, 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
Age
234965
Edge-Cache-Tag
575077299308468417590234438077035908298,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
7863
X-Request-Id
19c9873a9e40bdc6
X-Served-By
cache-hhn1537-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Mon, 13 May 2019 19:11:27 GMT
Server
cloudinary
X-Timer
S1559434184.442899,VS0,VE232
ETag
"31902de995c98904a55c605571f06530"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
KdrjrLOfPY-8B5XbJ3L-y-2e6ueMDNR4fsbg-JQ0eSeLTDxW2vbS8A==
X-Cache-Hits
0
arstechnica_war-stories-slay-the-spire-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/
15 KB
16 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/arstechnica_war-stories-slay-the-spire-war-stories.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 29 May 2019 00:05:34 GMT
Via
1.1 varnish, 1.1 61adf71a363fe0f836dc69dbb43de824.cloudfront.net (CloudFront)
Age
818657
Edge-Cache-Tag
515397136805965062020045600075132664421,404749671192515790889513374839386840902,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
15634
X-Request-Id
2d0da7ec326501f4
X-Served-By
cache-fra19145-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Thu, 02 May 2019 18:45:52 GMT
Server
cloudinary
X-Timer
S1559088335.611581,VS0,VE1
ETag
"abee90e53f29ba0127fca9442ab50902"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
My-zXLAtUecoucUAML9DAf3bUSkdRSpmwn6hyo2PzUEAbKrhIDg3Lg==
X-Cache-Hits
1
arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/
15 KB
16 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 21 May 2019 00:08:37 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
947844
Edge-Cache-Tag
587193118310891607619753694455047488726,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
15251
X-Request-Id
4a753e904b5f7094
X-Served-By
cache-hhn1539-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Tue, 16 Apr 2019 18:59:19 GMT
Server
cloudinary
X-Timer
S1558397317.096357,VS0,VE232
ETag
"3e7cdc13e718680bf5e1efa64468b560"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
K6CGMyR718pz_OZbLboIqHV13P3RwQZzEBd2MqUuo22c6MaePDLeiw==
X-Cache-Hits
0
arstechnica_war-stories-c-and-c-tiberian-sun.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/
19 KB
19 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/arstechnica_war-stories-c-and-c-tiberian-sun.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 28 May 2019 01:29:38 GMT
Via
1.1 varnish, 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
Age
237839
Edge-Cache-Tag
313687566273846460968749706722669918033,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
19022
X-Request-Id
2200c349462f9c83
X-Served-By
cache-hhn1528-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Wed, 27 Feb 2019 16:48:24 GMT
Server
cloudinary
X-Timer
S1559006978.808642,VS0,VE226
ETag
"fe52b9acd391d8bee8de15a0f429b377"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
BSdQccdxiP2wWY21ICNHhZWq_szcZKm_rSMePxOQKfqV2hUkfvLVsg==
X-Cache-Hits
0
arstechnica_army-s-next-vertical-lift-en-route.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550680609/
5 KB
6 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550680609/arstechnica_army-s-next-vertical-lift-en-route.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
4868ca91bcd0d492c501ec5b8d44ac78d3e1226977ae14ff598f5efe78751951

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 29 May 2019 00:18:27 GMT
Via
1.1 varnish, 1.1 61adf71a363fe0f836dc69dbb43de824.cloudfront.net (CloudFront)
Age
392444
Edge-Cache-Tag
312535560964408758261298476626669868625,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
4867
X-Request-Id
e3f346bec24d7ff3
X-Served-By
cache-hhn1532-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Thu, 21 Feb 2019 15:50:43 GMT
Server
cloudinary
X-Timer
S1559089107.834583,VS0,VE286
ETag
"90ad4d692f7209c01596b99729f26e7b"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
cwU_x2OLMgsY2AjJAc7dghuavxrDboNdgDbNQQvvVvEjgu5t5XGthQ==
X-Cache-Hits
0
arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/
18 KB
19 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 29 May 2019 00:11:29 GMT
Via
1.1 varnish, 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
Age
235070
Edge-Cache-Tag
292757494989914907279105994976263969890,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
18172
X-Request-Id
c3e7d96bbe014b80
X-Served-By
cache-hhn1535-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Fri, 15 Feb 2019 15:34:33 GMT
Server
cloudinary
X-Timer
S1559088690.594713,VS0,VE388
ETag
"32f1b8954559c8d598e9861f5b8360b9"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
m2jMFOe4OYBlscO0JvlkoARp4Pq_Rfd-hIpUD3FbJP6tT8aX_EHphQ==
X-Cache-Hits
0
arstechnica_war-stories-dead-space-the-drag-tentacle.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/
7 KB
8 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/arstechnica_war-stories-dead-space-the-drag-tentacle.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 02 Jun 2019 00:19:02 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
395830
Edge-Cache-Tag
561334743792169660751574031162860899763,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
7393
X-Served-By
cache-hhn1525-HHN
Last-Modified
Tue, 08 Jan 2019 16:38:58 GMT
Server
cloudinary
X-Timer
S1559434743.785754,VS0,VE1
ETag
"17a6e4b5eb75eb12f5d8c89eb3d0ace8"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
3mdSdpN8JIHaprgJrr9ytt7WvHhZFOlw_eQjfmewH_DZ_mnHXmzE8A==
X-Cache-Hits
1
arstechnica_teach-the-controversy-flat-earthers.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/
10 KB
11 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/arstechnica_teach-the-controversy-flat-earthers.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 02 Jun 2019 00:45:15 GMT
Via
1.1 varnish, 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
Age
1766467
Edge-Cache-Tag
522150850958368321191235208678465217967,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
10595
X-Request-Id
98a54be49b866b53
X-Served-By
cache-hhn1521-HHN
X-Cloud-Name
heru80fdn
Last-Modified
Fri, 09 Nov 2018 14:44:53 GMT
Server
cloudinary
X-Timer
S1559436315.461747,VS0,VE1
ETag
"6c0c4f8a9d61ed2b5863a8058c624a37"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
TQZbMRy62GIt38L7_zC3tHGTZ6YpW9mcLGim78FHStstfKxRjowboQ==
X-Cache-Hits
2
arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/
12 KB
13 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 02 Jun 2019 00:12:44 GMT
Via
1.1 varnish, 1.1 61adf71a363fe0f836dc69dbb43de824.cloudfront.net (CloudFront)
Age
236425
Edge-Cache-Tag
389498626973997838808844380914497340413,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
12509
X-Request-Id
ec5f066ff382a9d5
X-Served-By
cache-fra19162-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Fri, 21 Sep 2018 16:51:30 GMT
Server
cloudinary
X-Timer
S1559434364.715908,VS0,VE304
ETag
"b9c502ffc902b60d0eb13698b37a945d"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
60O0OvaDnp3I8iN33Mz-DBq-TXNZWF8uA7JjZPY1ifA4eYT7DVOyWA==
X-Cache-Hits
0
arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/
7 KB
8 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 20 May 2019 18:19:04 GMT
Via
1.1 varnish, 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
Age
1731290
Edge-Cache-Tag
294316597633303263276952824544497226127,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
7181
X-Served-By
cache-fra19129-FRA
Last-Modified
Fri, 06 Jul 2018 12:23:22 GMT
Server
cloudinary
X-Timer
S1558376344.111767,VS0,VE1
ETag
"0549828edcecd339d8d10ebe6119de70"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
BL5gDPOyTUdCiI_ljagnAqPzERIxcYJ5-LyYdDLUNsVtcxktypXGUA==
X-Cache-Hits
1
arstechnica_apollo-mission-episode-1.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/
14 KB
15 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/arstechnica_apollo-mission-episode-1.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 18 Jul 2019 00:20:06 GMT
Via
1.1 varnish, 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
Age
234475
Edge-Cache-Tag
424632948265147424317824738369264083785,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
14040
X-Request-Id
c70ffa0055b9d824
X-Served-By
cache-fra19173-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Tue, 05 Dec 2017 01:52:25 GMT
Server
cloudinary
X-Timer
S1563409206.386704,VS0,VE280
ETag
"ecc047c6eed3dc571a78eab647201220"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
oiYRZ5e78IAXtbgOIauPYj0zUV3JW5Si-Nyjx9jgw_k6S6k_ONW_1A==
X-Cache-Hits
0
arstechnica_richard-garriot-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/
14 KB
14 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/arstechnica_richard-garriot-war-stories.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 29 Aug 2019 12:07:45 GMT
Via
1.1 varnish, 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
Age
2441581
Edge-Cache-Tag
489732375708630852448407029403767769375,605383893367339607624947511135489672318,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
13885
X-Request-Id
56f9409314cf4fc3
X-Served-By
cache-fra19158-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Fri, 06 Jul 2018 19:56:42 GMT
Server
cloudinary
X-Timer
S1567080466.650456,VS0,VE347
ETag
"13d45a1733ad4d2f3ae707584d6a8a32"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
EouZUvpAFHjAImLjPMnp8tzov4x6DanNmTvCYfQ8OuFg4HNZb-yHCg==
X-Cache-Hits
0
truncated
/
408 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
EU
geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/
32 B
325 B
Script
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery3310062301500702552026_1569522046831&_=1569522046832
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.3.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
status
200
cf-ray
51c740f96a2159ee-VIE
content-length
32
wt
polarcdn-pentos.com/ Frame 7076
3 B
67 B
XHR
General
Full URL
https://polarcdn-pentos.com/wt?e=3&n=3&p=UNKNOWN&s=1&u=42d911ae-59b8-49f4-a4cd-c87b5a1fd621&v=2%2Fbd213b0&w=1.158.0&y=w&z=v1.6.48&pas=asa-web-polarpmp&pag1=conde_customcontent_market&pag2=brand_arstechnica&paenb=y&paena=a.650256cf-022e-4f60-a6e4-c56a0ac93e07.7363d8&paensm=n&pai=e55f9&d=arstechnica.com&l=&pajs=&pepm=gdpr-eu&pepc=n&mepc=1&pasf=0&paio=1&pasb=1&cu=835ad2a8b2616bc19965dab731d444a2&t=arx&parcid=b11d7&parid=d7f7a&parin=2&partm=1&par=s&maxts=0.225&pvhref=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_=1569522046649
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.78 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f0e2d95e318789b840f67b7004cb30985ce2e0ef3ece7507b2b15e8441811a7

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
258233
cf-ray
51c740f92a6ed6ed-FRA
status
200
content-length
3
x-amz-id-2
fdX907fwNt8pr3tw3gr73uFQXky3viGiZTMtdYbPcadu4V04bAegc8VyKwcCSRJX1hpdYoYX62c=
last-modified
Mon, 09 Jul 2018 17:31:51 GMT
server
cloudflare
etag
"28e4477bb454eb35226fe56082545e13"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
access-control-allow-methods
GET
x-amz-request-id
E1FE302C79362616
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
application/octet-stream
c748a70c670949d1ba1f096aa6a849d6
polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/creative/ Frame 7076
16 KB
4 KB
XHR
General
Full URL
https://polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/creative/c748a70c670949d1ba1f096aa6a849d6?order=4416eecf72b543d28b6f8d24b6338e52
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
85cfa513b1371f392e0b08376ad5ca0bbd15a0ac5ceb49912d067854a086ae81

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:46 GMT
content-encoding
gzip
server
cloudflare
status
200
etag
W/"22469bb29a08b9ea69935fdbe400e92d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Country, CF-Ray
cache-control
max-age=900
x-country
DE
cf-ray
51c740f938bfcbc0-VIE
user
4d.condenastdigital.com/
54 B
418 B
XHR
General
Full URL
https://4d.condenastdigital.com/user?xid=4b35fe76-c1f9-448c-943b-db0afdfd250c
Requested by
Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.209.40.151 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-209-40-151.compute-1.amazonaws.com
Software
/
Resource Hash
6b45855e4fce0088ab901606ad5a487f324be1950e44fb8c05de7d18ecdbe73e

Request headers

Accept
text/plain
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
transfer-encoding
chunked
Content-Type
application/json; charset=utf-8
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
Connection
keep-alive
get
odb.outbrain.com/utils/
15 KB
9 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=http%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&srcUrl=http%3A%2F%2Ffeeds.arstechnica.com%2Farstechnica%2Findex%2F&settings=true&recs=true&widgetJSId=JS_1&key=NANOWDGT01&idx=0&version=103034&apv=false&sig=mHFapR0A&format=vjapi&rand=57921&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1569522045990
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
0708a8b0556694dae44e3b943cf481a32943a7e56cdb81881cf1cadf69137d34
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, HHN, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
fdfabe1d57890ae1b40e1e623abb337
content-length
8932
x-served-by
cache-jfk8151-JFK, cache-hhn4047-HHN
pragma
no-cache
x-timer
S1569522047.927998,VS0,VE169
date
Thu, 26 Sep 2019 18:20:47 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.51
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
wt
polarcdn-pentos.com/ Frame 7076
3 B
67 B
XHR
General
Full URL
https://polarcdn-pentos.com/wt?e=4&n=3&p=NA-ARSTECH-11238837&s=1&u=42d911ae-59b8-49f4-a4cd-c87b5a1fd621&v=2%2Fbd213b0&w=1.158.0&y=w&z=v1.6.48&pas=asa-web-polarpmp&pag1=conde_customcontent_market&pag2=brand_arstechnica&paenb=y&paena=a.650256cf-022e-4f60-a6e4-c56a0ac93e07.7363d8&paenli=19cd92073d5649d39973010253748202&paenlip=771a6f08931c41f8ba9ee0ae491c5227&paeno=4416eecf72b543d28b6f8d24b6338e52&paenop=d8a8864a0ada41a982b0d9e5a6f68f32&paes=fd9a1a7c3cf24f9fb674bbc3a4ebe163&paensm=n&pai=e55f9&d=arstechnica.com&l=Key-native_xrail+%5BXrail%5D&pajs=body&pepm=gdpr-eu&pepc=n&mepc=1&pasf=0&paio=1&pasb=1&pecy=DE&c=16b1822042e34e28a4834bc0932ea6dd&pacexp=cd2dbc9cbb60416e8c5cea64bdf07bcd&t=i&pasp=6fe1dded4b5f4d1a8a01dfa8492cbdab&papss=a&pvhref=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&_=1569522046650
Requested by
Host: static.polarcdn.com
URL: https://static.polarcdn.com/creative/creative.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.78 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f0e2d95e318789b840f67b7004cb30985ce2e0ef3ece7507b2b15e8441811a7

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
258233
cf-ray
51c740f96b2cd6ed-FRA
status
200
content-length
3
x-amz-id-2
fdX907fwNt8pr3tw3gr73uFQXky3viGiZTMtdYbPcadu4V04bAegc8VyKwcCSRJX1hpdYoYX62c=
last-modified
Mon, 09 Jul 2018 17:31:51 GMT
server
cloudflare
etag
"28e4477bb454eb35226fe56082545e13"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
access-control-allow-methods
GET
x-amz-request-id
E1FE302C79362616
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
application/octet-stream
5d4ca34cfc70759534a8643e
polarcdn-terrax.com/image/v1.0.0/bin/
13 KB
13 KB
Image
General
Full URL
https://polarcdn-terrax.com/image/v1.0.0/bin/5d4ca34cfc70759534a8643e?v=a8aa4&w=300
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef50fbb6411e721a4ac6d3c69079bee687d754e01216c093c7bdadd279e0b64a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:46 GMT
via
1.1 varnish
vary
Accept-Encoding
cf-cache-status
HIT
age
97105
status
200
content-type
image/jpeg
content-length
13232
timing-allow-origin
*
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
432000
access-control-allow-methods
GET
x-varnish
1606696605 1606594060
access-control-allow-origin
*
cache-control
public, max-age=432000
accept-ranges
bytes
cf-ray
51c740f97d4acbc4-VIE
embed-api.json
player.cnevids.com/
6 KB
3 KB
Fetch
General
Full URL
https://player.cnevids.com/embed-api.json?videoId=5d826c83bcdfff482d6d06b0&embedLocation=arstechnica
Requested by
Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.13 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-13.fra53.r.cloudfront.net
Software
nginx/1.14.1 /
Resource Hash
66142e13bbe676019a4a5a291cd5f6b1b9175790f93e771b7179896fd3e67e34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Age
40
X-Cache
Hit from cloudfront
Status
200 OK
Access-Control-Max-Age
1728000
Connection
keep-alive
Content-Length
2085
X-XSS-Protection
1; mode=block
X-Request-Id
b2ba72ae-a9ef-4bfe-ba4b-9d00eec15609
X-Runtime
0.008762
X-Backend-Node
10.110.120.110
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx/1.14.1
ETag
W/"b7c290cad44363d746520cfed5961299"
X-Download-Options
noopen
Vary
Origin,Accept-Encoding
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
application/json; charset=utf-8
Via
1.1 e8b17f734954ee4d46d26cf302323482.cloudfront.net (CloudFront)
Access-Control-Expose-Headers
Cache-Control
max-age=0, private, must-revalidate
X-Amz-Cf-Pop
FRA53-C1
Access-Control-Allow-Origin
*
X-Amz-Cf-Id
VI9aL8uiGkhltRHImf1bonozVodb17pl1lggDn8wHy0g-C9OTNFodQ==
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 3191
263 KB
89 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
99ddca22fc298fbc23f9048c7b3b8d87edd49aaa20e3b32ab169f2e859838e5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
91447
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:47 GMT
gpt_proxy.js
imasdk.googleapis.com/js/sdkloader/
66 KB
24 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/gpt_proxy.js
Requested by
Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
de10c14ed6d1a691cf1d50f0b454e4dfc28fe44a11090e105a6fbb8a0376bf3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:18:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 24 Sep 2019 19:38:32 GMT
server
sffe
age
127
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24532
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:33:40 GMT
player-style-3b3a013ac40046610e8f2fefe02c3b07.css
d2c8v52ll5s99u.cloudfront.net/player/ Frame 3191
74 KB
12 KB
Stylesheet
General
Full URL
https://d2c8v52ll5s99u.cloudfront.net/player/player-style-3b3a013ac40046610e8f2fefe02c3b07.css
Requested by
Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.222.190 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-222-190.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
596b76b93c7801ba85fb53f2f6e2281d4dbffc96ddc18bb056e8cb0e94be34fd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 05 Jun 2019 16:07:32 GMT
Content-Encoding
gzip
Age
9771196
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
11365
Last-Modified
Wed, 05 Jun 2019 16:03:54 GMT
Server
AmazonS3
ETag
"cff060eda5015972d532696ec91d375b"
Content-Type
text/css; charset=utf-8
Via
1.1 bab68affea15bbe0bb14b61f027cc282.cloudfront.net (CloudFront)
Cache-Control
max-age=63072000, public
X-Amz-Cf-Pop
FRA56
Accept-Ranges
bytes
X-Amz-Cf-Id
GuhIkFu4KVxJGyDmUhZWueXXS_qqbxbud-26bxFMIr1exUhk2z23Qw==
Expires
Tue, 01 Jan 2030 00:00:00 GMT
main-7c53e77591569f053696.js
d2c8v52ll5s99u.cloudfront.net/player/ Frame 3191
917 KB
230 KB
Script
General
Full URL
https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Requested by
Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5d826c83bcdfff482d6d06b0.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady29077522
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.222.190 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-222-190.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
34281fadc76859e23ccb1d773e88cb5d01b0019ac0d7208fa790e9f21bf34d46

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 24 Sep 2019 19:40:22 GMT
Content-Encoding
gzip
Age
168026
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
235414
Last-Modified
Tue, 24 Sep 2019 19:18:08 GMT
Server
AmazonS3
ETag
"c9e473ee5632557c0a889199e98760d3"
Content-Type
application/javascript
Via
1.1 a853d87afe2972a208a9cd92a357386b.cloudfront.net (CloudFront)
Cache-Control
max-age=63072000, public
X-Amz-Cf-Pop
FRA56
Accept-Ranges
bytes
X-Amz-Cf-Id
Gd1-s9-tN_cwKEdEg1SZTt-K2T3rt5WgNrwFNh3TpIG2qMpcDVkpCA==
Expires
Tue, 01 Jan 2030 00:00:00 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
/
www.facebook.com/tr/ Frame 0F18
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
2512
pragma
no-cache
cache-control
no-cache
origin
https://arstechnica.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
cookie
fr=0Q0Wj1wAv1cFDi2x0..BdjQF-...1.0.BdjQF-.
Origin
https://arstechnica.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://arstechnica.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-length
0
server
proxygen-bolt
date
Thu, 26 Sep 2019 18:20:47 GMT
9f09b194-fc18-4a93-a357-d0a3ec4968e1
https://arstechnica.com/ Frame 3191
31 B
0
Other
General
Full URL
blob:https://arstechnica.com/9f09b194-fc18-4a93-a357-d0a3ec4968e1
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
31
Content-Type
application/javascript
sf-ui-display-medium-webfont.woff2
d2c8v52ll5s99u.cloudfront.net/assets/fonts/ Frame 3191
29 KB
30 KB
Font
General
Full URL
https://d2c8v52ll5s99u.cloudfront.net/assets/fonts/sf-ui-display-medium-webfont.woff2
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.222.190 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-222-190.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3

Request headers

Sec-Fetch-Mode
cors
Referer
https://d2c8v52ll5s99u.cloudfront.net/player/player-style-3b3a013ac40046610e8f2fefe02c3b07.css
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:48 GMT
Content-Encoding
gzip
Vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
X-Amz-Cf-Pop
FRA56
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
29632
Access-Control-Allow-Origin
*
Last-Modified
Mon, 26 Jun 2017 15:24:42 GMT
Server
AmazonS3
ETag
"7d18db04f980971f2a9c5026bbc34bed"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/font-woff2
Via
1.1 63db28734e1b9429c04087abd41a1692.cloudfront.net (CloudFront)
Cache-Control
max-age=63072000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
XAd28wxiUj3rp90kidhF0Ann_NE-GD2PRLJLk6kFXYjh2IPlBC13Qg==
Expires
Tue, 01 Jan 2030 00:00:00 GMT
bridge3.335.0_en.html
imasdk.googleapis.com/js/core/ Frame C9D6
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.335.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.335.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
194466
date
Thu, 26 Sep 2019 14:10:08 GMT
expires
Fri, 25 Sep 2020 14:10:08 GMT
last-modified
Tue, 24 Sep 2019 19:35:34 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
15039
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/ Frame 3191
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
10523
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:47 GMT
integrator.js
adservice.google.com/adsid/ Frame 3191
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=arstechnica.com
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
fbevents.js
connect.facebook.net/en_US/ Frame 3191
121 KB
31 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31604
x-xss-protection
0
pragma
public
x-fb-debug
dRdBLaZRBbFS7zW+yoGak2V4gvGqhvAQHlfzU4+GeAfaPl2oFz8+KaXACGKycim0aFMO3MADJO4+DrQaMvLIow==
x-fb-trip-id
194532234
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:47 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
expires
Sat, 01 Jan 2000 00:00:00 GMT
comscore-min.js
d2c8v52ll5s99u.cloudfront.net/player/ Frame 3191
38 KB
11 KB
Script
General
Full URL
https://d2c8v52ll5s99u.cloudfront.net/player/comscore-min.js
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.222.190 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-222-190.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 24 May 2017 18:19:15 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Via
1.1 a84a4d90dd581e1a1c18e1bf5992b931.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
PEGFq5-XV4X3-JnPE5VxYjXg8LNBAHAb1FRuFuMSoWF54ynMMaUxlA==
collect
www.google-analytics.com/r/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/r/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.129Z&_c=&_t=Player%20Requested&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.237Z&_c=Performance&_t=adj_loaderjs_assets_loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=134.00000054389238&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.238Z&_c=Performance&_t=adj_loaderjs_loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=0.090000219643116&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.238Z&_c=Performance&_t=adj_script_embed_loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=0.0350000336766243&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.238Z&_c=Performance&_t=adj_player_download_time&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=65.59500005096197&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.242Z&_c=Performance&_t=adj_player_set_src&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=247.94000014662743&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/ Frame 3191
65 KB
66 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/arstechnica_war-stories-civilization.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
f513c914f8f3cf4975bf34937100375c4b4164ec77ec011488b643452f6ae22f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Sep 2019 15:13:51 GMT
Via
1.1 varnish, 1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
Age
270416
Edge-Cache-Tag
390602458176548494884398897259766670181,316951410886732526360935603098811400471,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
66728
X-Request-Id
44faf04ca234bc99
X-Served-By
cache-fra19143-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Mon, 23 Sep 2019 15:00:59 GMT
Server
cloudinary
X-Timer
S1569251631.287169,VS0,VE180
ETag
"c43a026bdd689dfa9ab341b71ae2cd02"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
BX84Iwvx_MDiBu79ZBfpAzlVLC7ySyX2-o3_p6Y_VkI7a81d8ZbXZA==
X-Cache-Hits
0
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A47.320Z&_t=pageview&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=3900&pSw=1600&pSh=1200&uID=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&uDt=desktop&_o=ars-technica&_c=general&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
34483233-a98f-4020-929a-0a3b80c0b769thumbs.mp4
dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/ Frame 3191
15 KB
0
Media
General
Full URL
https://dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/34483233-a98f-4020-929a-0a3b80c0b769thumbs.mp4
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-44.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Date
Thu, 26 Sep 2019 09:05:48 GMT
Via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
Last-Modified
Wed, 18 Sep 2019 17:46:59 GMT
Server
AmazonS3
Age
33300
ETag
"95fd1c34edea880d5b998b6cc199590d"
X-Cache
Hit from cloudfront
Content-Type
video/mp4
Content-Range
bytes 0-1810475/1810476
Connection
keep-alive
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Content-Length
1810476
X-Amz-Cf-Id
Bcni5SX3o0YbKH6zF-4JQ0kXjapfT3q8hCy-yl5YdyszudqkRwg-hQ==
34483233-a98f-4020-929a-0a3b80c0b769thumbs.mp4
dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/ Frame 3191
79 KB
0
Media
General
Full URL
https://dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/34483233-a98f-4020-929a-0a3b80c0b769thumbs.mp4
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-44.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Date
Thu, 26 Sep 2019 09:05:48 GMT
Via
1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
Last-Modified
Wed, 18 Sep 2019 17:46:59 GMT
Server
AmazonS3
Age
33300
ETag
"95fd1c34edea880d5b998b6cc199590d"
X-Cache
Hit from cloudfront
Content-Type
video/mp4
Content-Range
bytes 0-1810475/1810476
Connection
keep-alive
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Content-Length
1810476
X-Amz-Cf-Id
_ejrmuA7J1wt4tWvFh3oibPDMIQNZMZg_DwBbDVhllR7yFRHWaNsEw==
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.396Z&_c=Player%20Event&_t=Player%20Loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
d4f5dfb2-7a62-4556-a6e5-70ee085f3cf8
https://arstechnica.com/ Frame 3191
5 KB
0
Other
General
Full URL
blob:https://arstechnica.com/d4f5dfb2-7a62-4556-a6e5-70ee085f3cf8
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
5463
Content-Type
application/javascript
34483233-a98f-4020-929a-0a3b80c0b769manifest-ios.m3u8
dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/ Frame 3191
918 B
1 KB
XHR
General
Full URL
https://dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/34483233-a98f-4020-929a-0a3b80c0b769manifest-ios.m3u8?videoIndex=0&requester=oo
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-44.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
174dec2e7da4b324c72c1d5fd1591832b170024d71fec278f94554452cea9f53

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 16:47:14 GMT
Via
1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
Vary
Origin
Age
5614
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
918
Last-Modified
Wed, 18 Sep 2019 17:45:26 GMT
Server
AmazonS3
ETag
"43f83b685faa046cc9c39efc39fc5eb7"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET, HEAD
Content-Type
application/x-mpegURL
Access-Control-Allow-Origin
*
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
jAMxIZsZUM9qoPjbHW2UwZ6NhX_ff33W1TNly5sw1HDxMEvOrp5Y9w==
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.404Z&_c=Performance&_t=adj_hls_request_manifest&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=410.0799998268485&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame F121
0
0
Document
General
Full URL
https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1569522045990
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3746974845~rv=49~id=bc8dabae62a3dcf9758b5afd5148039a; recs_b8bcfca37ad3a5a024311f033f791f3e=0B1925901673A2040085455A2165095251A2328508406A2395761389A2023078629ACD1; obuid=4cb85206-dbd7-419e-b0cf-fccbc0826194
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/

Response headers

Server
Apache
ETag
"5feb1da517bdf722d2cb7307d08b0751:1569500114"
Last-Modified
Thu, 26 Sep 2019 11:52:42 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=604800
Date
Thu, 26 Sep 2019 18:20:47 GMT
Content-Length
3650
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
l
mcdp-nydc1.outbrain.com/
4 B
375 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=9d6fd42765b1b879a1eee3b871560ac6_6817_1569522047046&tm=1115&eT=0&wRV=103034&pVis=0&lsd=4cb85206-dbd7-419e-b0cf-fccbc0826194&eIdx=&cheq=0&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1569522045990
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
c6a488e35b314f7cac4a0139443f24
Content-Length
30
eyJpdSI6IjAyYzY2MDNhNmVjZGFhMGU1ZTZhMTNiYTg4NTJlZTA4N2Q5ZTI1MTE3ZmQzNjI1MzljZTkyYmEyMDFjNThkZDIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
4 KB
4 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjAyYzY2MDNhNmVjZGFhMGU1ZTZhMTNiYTg4NTJlZTA4N2Q5ZTI1MTE3ZmQzNjI1MzljZTkyYmEyMDFjNThkZDIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fc3bb7c8bfac2d11524767f5561b412a25ebefb85cd5f891a687ead5280f4739
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 05 Sep 2019 07:12:00 GMT
Date
Thu, 26 Sep 2019 18:20:47 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2462400
Connection
keep-alive
X-TraceId
17848c87c06dc093c72edb4cbf2ba42b
Timing-Allow-Origin
*
Content-Length
4096
eyJpdSI6ImNiMjQ5ZjQxNDg3MDc1NWM3ZmY3NjQ1MWVkYzgzNDdjNGFkNTdmODZiZWJlMGVjNmI1Y2Y5ZWUwN2JmN2VlNDUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
7 KB
7 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImNiMjQ5ZjQxNDg3MDc1NWM3ZmY3NjQ1MWVkYzgzNDdjNGFkNTdmODZiZWJlMGVjNmI1Y2Y5ZWUwN2JmN2VlNDUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d68ecae0760b7bb2b9d1d2a5da8945322770f5f2c5a3a188b50ebbb013f8953
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Sun, 15 Sep 2019 15:01:39 GMT
Date
Thu, 26 Sep 2019 18:20:47 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2325533
Connection
keep-alive
X-TraceId
67546811726643ad000fbb64fd523f68
Timing-Allow-Origin
*
Content-Length
7122
eyJpdSI6IjJjNDFmMGQ2MGE0OWUxNjI0MzE4NDgyY2IyYjJlMGI0MDhhMzk4NjM2NmU0NTViY2ZiNTFlZTkyMjAyOWIwYTMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
9 KB
9 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjJjNDFmMGQ2MGE0OWUxNjI0MzE4NDgyY2IyYjJlMGI0MDhhMzk4NjM2NmU0NTViY2ZiNTFlZTkyMjAyOWIwYTMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a04cef2e415d691c895cc8edfc1f0b47da2d3b8bbb7a3114337f682a1114dc73
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Mon, 02 Sep 2019 15:25:12 GMT
Date
Thu, 26 Sep 2019 18:20:47 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2325533
Connection
keep-alive
X-TraceId
9a93bce21be09fa5726edb778963154b
Timing-Allow-Origin
*
Content-Length
9100
eyJpdSI6IjIwNWJkZTdiNDg5NDIwZDhiMDdjNDRhY2NmM2VjYTI5NjM5YTk3MWVkM2E1MTVlNWYzOTFmYTQ5YTRkN2I4YzIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
4 KB
4 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjIwNWJkZTdiNDg5NDIwZDhiMDdjNDRhY2NmM2VjYTI5NjM5YTk3MWVkM2E1MTVlNWYzOTFmYTQ5YTRkN2I4YzIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a250307d9edcde82e8320ab9d260d8109a168ab6b3a9fe935368734bf66e5cdb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Aug 2019 20:37:19 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=526231
Connection
keep-alive
X-TraceId
424f6d00f63ac1ca567ca4dbac0ade59
Timing-Allow-Origin
*
Content-Length
3624
eyJpdSI6ImQ1N2RiZDE4NzQ4YTZmODE4YzkyNTZhNzQyN2FkMGJhNGNjYmE2MTJjMDEzNzY0ZTg2MDkxNGMxYWFhODRkYzAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
7 KB
7 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImQ1N2RiZDE4NzQ4YTZmODE4YzkyNTZhNzQyN2FkMGJhNGNjYmE2MTJjMDEzNzY0ZTg2MDkxNGMxYWFhODRkYzAiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b89a77801a8876ffddec1c1eb556d814f1301800ba03814886903c630db92cde
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 07:40:13 GMT
Date
Thu, 26 Sep 2019 18:20:47 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2462400
Connection
keep-alive
X-TraceId
3fa7ab8ca7384d7daa4a6363ddd26791
Timing-Allow-Origin
*
Content-Length
7094
eyJpdSI6ImJhNTk0NDJjOTE3Zjg2ZTYzNWNkOTNlMWZkZGRkYTFkYWRjMTI0ZjI2YmI5Y2EwMTlmOTNkZmE2OWFkNjNiMTYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
8 KB
9 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImJhNTk0NDJjOTE3Zjg2ZTYzNWNkOTNlMWZkZGRkYTFkYWRjMTI0ZjI2YmI5Y2EwMTlmOTNkZmE2OWFkNjNiMTYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
28079e85a27d754124da880e95fd943a109d646537adb51d575e53bbf0c87310
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Fri, 06 Sep 2019 07:47:45 GMT
Date
Thu, 26 Sep 2019 18:20:47 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1969753
Connection
keep-alive
X-TraceId
bd582e5a8c74fb65a1537e4a84eca765
Timing-Allow-Origin
*
Content-Length
8336
1663130473914833
connect.facebook.net/signals/config/ Frame 3191
307 KB
78 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1663130473914833?v=2.9.4&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
16758a4acd30f566e1b0a96b2305b89c354d4aac95a060a669925ecf2977d8dd
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
79754
x-xss-protection
0
pragma
public
x-fb-debug
hm460YHK7412LMPN/1w/DZkHZ/oAD0e7rGcz0mc3R6+60Hf2r4uItDQaNL476V+M3Ouuau1Nlxc8wSyaAZmxEg==
x-fb-trip-id
194532234
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:47 GMT
vary
Origin, Accept-Encoding
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
iab
api.skimlinks.mgr.consensu.org/
772 B
636 B
XHR
General
Full URL
https://api.skimlinks.mgr.consensu.org/iab?nocache=1569522047427
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
172.40.190.35.bc.googleusercontent.com
Software
nginx/1.14.0 /
Resource Hash
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.14.0
access-control-allow-headers
*
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://arstechnica.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
ads
securepubads.g.doubleclick.net/gampad/
293 B
278 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4018847106260845&correlator=1666555318833230&output=ldjh&callback=googletag.impl.pubads.callbackProxy3&impl=fifs&adsid=NT&eid=21062818&vrg=2019091901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190926&iu_parts=3379%2Cars.dart%2Cinformation-technology&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x140&prev_scp=pos%3Dsponsor%26ctx_slot_type%3Dnative_xrail%26ctx_slot_rn%3D0%26pos_instance%3D2%26ctx_slot_instance%3D1%26ctx_slot_name%3Dnative_xrail_1&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_topic_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_entities%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_ent_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_keywords%3Dconfiguration_file%252Cgoogle_play%252Capp%252Cadvertisement%252Capplication%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cdeveloper%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Cuser%252Csecurity_screening%26vnd_4d_ctx_kw_sc%3D1%252C0.9728098695643983%252C0.9391706607221941%252C0.8689376632349042%252C0.8335926704306043%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.5539613931194098%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4609739116050188%252C0.45091407169070846%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C112200%252C120000%252C121100%252C131100%252C112221%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252C0lw01o%252Cwmhp4i%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cedmh3jrtlez%26ctx_advertisers%3D1454517775%26ctx_line_items%3D4736014287%26ctx_creatives%3D138237302059%26vnd_4d_sid%3Dbffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%26vnd_4d_pid%3De6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%26vnd_4d_xid%3D4b35fe76-c1f9-448c-943b-db0afdfd250c%26vnd_ars_data%3D100k_pvs&cookie=ID%3Da453d3982840876d%3AT%3D1569522046%3AS%3DALNI_MYnK6OOlxN2c6BXJgyJnQcLQbRhCA&cookie_enabled=1&bc=31&abxe=1&lmt=1569522047&dt=1569522047440&dlt=1569522045603&idt=478&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=661&adks=1840483543&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dssz=80&icsg=255705172934656&mso=262144&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x0&msz=300x140&ga_vid=472596231.1569522046&ga_sid=1569522046&ga_hid=1264286218&fws=516&ohw=300
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
974bf7a9b3f6e256784e9472234ad50ea30a62f927569fe3b48ecfebfa0fbd2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
103
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
34483233-a98f-4020-929a-0a3b80c0b769file-1422k-128-48000-768.m3u8
dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/ Frame 3191
10 KB
1 KB
XHR
General
Full URL
https://dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/34483233-a98f-4020-929a-0a3b80c0b769file-1422k-128-48000-768.m3u8?requester=oo
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-44.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3495e9f8299dc6ef6234bf69cea0e36741cf4613cd8e1d30763105546305999d

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 16:47:14 GMT
Content-Encoding
gzip
Vary
Origin
Age
5614
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Access-Control-Allow-Origin
*
Last-Modified
Wed, 18 Sep 2019 17:49:17 GMT
Server
AmazonS3
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET, HEAD
Content-Type
application/x-mpegURL
Via
1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
0F9A-pu0uWQdM-upkxCjVKRYPODIZbpOeXnC-9VlNTsMDj7o2MGPSg==
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.475Z&_c=Performance&_t=adj_hls_request_playlist&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=481.37000016868114&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
getpixels
pixels.ad.gt/api/v1/
0
343 B
Script
General
Full URL
https://pixels.ad.gt/api/v1/getpixels?tagger_id=dff93e0c28e37b18185bb23914a47234&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&code=%27none%27
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/57
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.43.157.238 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-43-157-238.us-west-2.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Thu, 26 Sep 2019 18:20:48 GMT
server
nginx/1.14.1
access-control-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
ecommerce.js
www.google-analytics.com/plugins/ua/
1 KB
826 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ecommerce.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 17:26:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
3254
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
735
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:26:33 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 17:48:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
1948
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
1296
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:48:19 GMT
conde_nast_xid
ids.ad.gt/api/v1/put/
43 B
629 B
Image
General
Full URL
https://ids.ad.gt/api/v1/put/conde_nast_xid?conde_nast_xid=4b35fe76-c1f9-448c-943b-db0afdfd250c
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.98.6 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-167-98-6.us-west-2.compute.amazonaws.com
Software
nginx/1.8.1 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:48 GMT
Cache-Control
public, max-age=43200
Expires
Fri, 27 Sep 2019 06:20:48 GMT
Server
nginx/1.8.1
Connection
keep-alive
transfer-encoding
chunked
Content-Type
image/gif
/
srv-2019-09-26-18.pixel.parsely.com/plogger/
43 B
229 B
Image
General
Full URL
https://srv-2019-09-26-18.pixel.parsely.com/plogger/?rand=1569522047494&plid=76784862&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22parsely_uuid%22%3A%2206e1025f-bcc1-40ac-b4cb-c85bb9808289%22%2C%22parsely_site_uuid%22%3A%22b702a1b8-3f42-42c0-9a3f-030266f0ed98%22%7D&sid=1&surl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&sref=&sts=1569522047490&slts=0&title=Google+Play+apps+laden+with+ad+malware+were+downloaded+by+millions+of+users+%7C+Ars+Technica&date=Thu+Sep+26+2019+20%3A20%3A47+GMT%2B0200+(Central+European+Summer+Time)&action=pageview&pvid=15138380&u=b702a1b8-3f42-42c0-9a3f-030266f0ed98
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.171.99.132 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-171-99-132.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
db05dfc6-a92d-4b28-9bfc-ecb21f2f8ab4
https://arstechnica.com/ Frame 3191
64 KB
0
Other
General
Full URL
blob:https://arstechnica.com/db05dfc6-a92d-4b28-9bfc-ecb21f2f8ab4
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4b188a568fa90fa61d4bbe76dd6cf523abe65787e0ac3dc6b5c44db5e823685b

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
65790
Content-Type
application/javascript
34483233-a98f-4020-929a-0a3b80c0b769file-1422k-128-48000-768-00001.ts
dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/ Frame 3191
596 KB
576 KB
XHR
General
Full URL
https://dp8hsntg6do36.cloudfront.net/5d826c83bcdfff482d6d06b0/34483233-a98f-4020-929a-0a3b80c0b769file-1422k-128-48000-768-00001.ts?requester=oo
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-44.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c4b1dd4bb7210351cac5fd51aaf55a2220532739c042c15ae3667aa3d1198079

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 16:47:15 GMT
Content-Encoding
gzip
Vary
Origin
Age
5613
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Access-Control-Allow-Origin
*
Last-Modified
Wed, 18 Sep 2019 17:49:12 GMT
Server
AmazonS3
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET, HEAD
Content-Type
application/x-mpegURL
Via
1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
X-Amz-Cf-Id
i_CO4SnpQL3fgP8NZy_5N2ucHWfy2tcUq3eSQ_qmqMfWikRf6hTUSA==
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.510Z&_c=Performance&_t=adj_hls_request_segment_1&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=516.5900001302361&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=43&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatDfpSlotId=native_xrail_1&zMoatRendered=3&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=2&zMoatPageDataTargetingSet=3&zMoatSafetyTargetingSet=3&zMoatEmptySlot=2&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=520514256&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:47 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A47.523Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4000&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&uNw=1&uUq=1&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fars.dart%2Finformation-technology%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22native_xrail_1%22%2C%22instance%22%3A%221%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22native_xrail_1%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x140%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522047523%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22sponsor%22%5D%2C%22ctx_slot_type%22%3A%5B%22native_xrail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%222%22%5D%2C%22ctx_slot_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_name%22%3A%5B%22native_xrail_1%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
page
t.skimresources.com/api/v2/
22 B
91 B
XHR
General
Full URL
https://t.skimresources.com/api/v2/page
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
via
1.1 google
x-content-type-options
nosniff
server
Python/3.7 aiohttp/3.5.4
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
22
link
t.skimresources.com/api/v2/
22 B
383 B
XHR
General
Full URL
https://t.skimresources.com/api/v2/link
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:47 GMT
via
1.1 google
x-content-type-options
nosniff
server
Python/3.7 aiohttp/3.5.4
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
access-control-allow-origin
https://arstechnica.com
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
22
arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/ Frame 3191
65 KB
66 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/arstechnica_war-stories-civilization.jpg
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
f513c914f8f3cf4975bf34937100375c4b4164ec77ec011488b643452f6ae22f

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Origin
https://arstechnica.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Sep 2019 15:13:51 GMT
Via
1.1 varnish, 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
Age
270416
Edge-Cache-Tag
390602458176548494884398897259766670181,316951410886732526360935603098811400471,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
66728
X-Request-Id
44faf04ca234bc99
X-Served-By
cache-fra19143-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Mon, 23 Sep 2019 15:00:59 GMT
Server
cloudinary
X-Timer
S1569251631.287169,VS0,VE180
ETag
"c43a026bdd689dfa9ab341b71ae2cd02"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
_Qd2f3KO96VterrSyCB4WioYl3h4guCodUjohXaP2-XLXrtbnR_lLQ==
X-Cache-Hits
0
arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/ Frame 3191
65 KB
66 KB
Image
General
Full URL
https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1569003425/arstechnica_war-stories-civilization.jpg
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.208.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-208-86.fra53.r.cloudfront.net
Software
cloudinary /
Resource Hash
f513c914f8f3cf4975bf34937100375c4b4164ec77ec011488b643452f6ae22f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Sep 2019 15:13:51 GMT
Via
1.1 varnish, 1.1 15d3b4db3728feaae1780610a1bac86e.cloudfront.net (CloudFront)
Age
270416
Edge-Cache-Tag
390602458176548494884398897259766670181,316951410886732526360935603098811400471,bd072c9835b885d44d7447102f8695ad
Status
200 OK
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
66728
X-Request-Id
44faf04ca234bc99
X-Served-By
cache-fra19143-FRA
X-Cloud-Name
heru80fdn
Last-Modified
Mon, 23 Sep 2019 15:00:59 GMT
Server
cloudinary
X-Timer
S1569251631.287169,VS0,VE180
ETag
"c43a026bdd689dfa9ab341b71ae2cd02"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With,Range,User-Agent
X-Amz-Cf-Id
4mL-Qii57L5r_UKScdBj6Z0ZtrVt6QFjciT3-uZq_FSwrj-cWwZjzA==
X-Cache-Hits
0
inferredEvents.js
connect.facebook.net/signals/plugins/ Frame 3191
35 KB
10 KB
Script
General
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id
194532234
pragma
private
x-fb-debug
yQoo2TGdKKLQOiijsUyu7JIT8s3+Jw1ia3AvyuJIMHMuiDQnwl3q/eJa/m5EJ1RNSeIgzIrLMUlLozC7Phul2g==
content-encoding
gzip
x-content-type-options
nosniff
x-frame-options
DENY
date
Thu, 26 Sep 2019 18:20:47 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
private
vary
Accept-Encoding
content-length
10218
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A47.635Z&_c=Performance&_t=adj_content_ready&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&_v=641.2650002166629&adId=&pageType=article%7Creport
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
ads
securepubads.g.doubleclick.net/gampad/
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4018847106260845&correlator=1666555318833230&output=ldjh&callback=googletag.impl.pubads.callbackProxy4&impl=fifs&adsid=NT&eid=21062818&vrg=2019091901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190926&iu_parts=3379%2Cconde.ars%2Crail%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Drail%26ctx_slot_type%3Dsiderail%26ctx_slot_rn%3D0%26m_mv%3DslotNoHistData%26m_gv%3DslotNoHistData%26amznbid%3D2%26amznp%3D2%26IOM%3D300x600_1%2C300x250_1%26ix_id%3D_3vTRBZjZ%2C_3vTRBZjZ%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dsiderail_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_topic_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_entities%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_ent_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_keywords%3Dconfiguration_file%252Cgoogle_play%252Capp%252Cadvertisement%252Capplication%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cdeveloper%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Cuser%252Csecurity_screening%26vnd_4d_ctx_kw_sc%3D1%252C0.9728098695643983%252C0.9391706607221941%252C0.8689376632349042%252C0.8335926704306043%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.5539613931194098%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4609739116050188%252C0.45091407169070846%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C112200%252C120000%252C121100%252C131100%252C112221%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252C0lw01o%252Cwmhp4i%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cedmh3jrtlez%26ctx_advertisers%3D1454517775%26ctx_line_items%3D4736014287%26ctx_creatives%3D138237302059%26vnd_4d_sid%3Dbffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%26vnd_4d_pid%3De6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%26vnd_4d_xid%3D4b35fe76-c1f9-448c-943b-db0afdfd250c%26vnd_ars_data%3D100k_pvs&cookie_enabled=1&bc=31&abxe=1&lmt=1569522047&dt=1569522047643&dlt=1569522045603&idt=478&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=370&adks=1483574547&ucis=7&ifi=7&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dssz=83&icsg=1022820691738624&mso=262144&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x250&ga_vid=472596231.1569522046&ga_sid=1569522046&ga_hid=1264286218&fws=516&ohw=300
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
5a8c7baa92ef22804b8840eef8a0b4c426e13886bd2e130eb25a307f017c056c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2536
x-xss-protection
0
google-lineitem-id
5046264854
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138268321125
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
12 KB
6 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4018847106260845&correlator=1666555318833230&output=ldjh&callback=googletag.impl.pubads.callbackProxy5&impl=fifs&adsid=NT&eid=21062818&vrg=2019091901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190926&iu_parts=3379%2Cconde.ars%2Chero%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=728x90%7C970x250%7C9x1%7C10x1&prev_scp=pos%3Dhero%26ctx_slot_type%3Dpost_nav%26ctx_slot_rn%3D0%26m_mv%3DslotNoHistData%26m_gv%3DslotNoHistData%26amznbid%3D2%26amznp%3D2%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dpost_nav_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_topic_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_entities%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_ent_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_keywords%3Dconfiguration_file%252Cgoogle_play%252Capp%252Cadvertisement%252Capplication%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cdeveloper%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Cuser%252Csecurity_screening%26vnd_4d_ctx_kw_sc%3D1%252C0.9728098695643983%252C0.9391706607221941%252C0.8689376632349042%252C0.8335926704306043%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.5539613931194098%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4609739116050188%252C0.45091407169070846%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C112200%252C120000%252C121100%252C131100%252C112221%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252C0lw01o%252Cwmhp4i%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cedmh3jrtlez%26ctx_advertisers%3D1454517775%26ctx_line_items%3D4736014287%26ctx_creatives%3D138237302059%26vnd_4d_sid%3Dbffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%26vnd_4d_pid%3De6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%26vnd_4d_xid%3D4b35fe76-c1f9-448c-943b-db0afdfd250c%26vnd_ars_data%3D100k_pvs&cookie_enabled=1&bc=31&abxe=1&lmt=1569522047&dt=1569522047660&dlt=1569522045603&idt=478&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=80&adks=2385402828&ucis=9&ifi=9&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dssz=83&icsg=1022820691738624&mso=262144&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x90&msz=1585x90&ga_vid=472596231.1569522046&ga_sid=1569522046&ga_hid=1264286218&fws=4&ohw=1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
5ae2fd1a7f8a75d5c9b9a45cb869d8b4aa4c6f5abae8cee0acb65d2bfd59ffed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:48 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5612
x-xss-protection
0
google-lineitem-id
5157593682
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138285540387
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
headerstats
as-sec.casalemedia.com/
0
339 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:47 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 26 Sep 2019 18:20:47 GMT
headerstats
as-sec.casalemedia.com/
0
339 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:47 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 26 Sep 2019 18:20:47 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 377D
0
63 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuBIxNh_5Ob52g9bEyEfFNjf8nNYqAoxPi6r0OhuwpNLokdyM4e6DMlNRDTsdWYq1gv94I6URPmcGnNp3fUlRiT8vhW1lX77vmvs584HOeP9D8fsvFc_150latMAlgWniSvIqWEY_6TTXyxHrR5FOoivKe3-QeKHSt9Hgosmo10RLhGtXtOYSb9ma6AAptSsPftpX14uL0iacQ6tVDVTOvE7fLCILicnoNNB8k1MBTPxj5bnmGgOyPFjz4UK3icGEIPiMFjMMyqoB3eH0-5gPxiib_8k1ZT5XEowS3vKJkyciK0jceRJg&sig=Cg0ArKJSzNrnvtZl9uqbEAE&urlfix=1&adurl=
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:47 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 377D
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6182dfae0694d2f06ce0ba9e18b21af30bdc62b4878767761059e6f03cba08e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569237451959804"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
29692
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:47 GMT
moatad.js
z.moatads.com/condenastdfp9588492144/ Frame 377D
297 KB
99 KB
Script
General
Full URL
https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
0018ca8c16b5f2b4a5b90fbdf2a7f9efe679564ecbc13b37fdbc73f44118606f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:35:01 GMT
Server
AmazonS3
x-amz-request-id
639B29FE24B49EB3
ETag
"2d31e9923188682b1c63d504e9908fc1"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=54944
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
100930
x-amz-id-2
HIs4QpCnBui/IprT2fzBJH0sNycsABuS/+9xV1xEGoOlhbLT2VcAQGFedHbIqEXmz2ORmBAMl9w=
imgad
tpc.googlesyndication.com/pagead/ Frame 377D
79 KB
79 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKCHgsaS3wEQARgBMghJ2R6KOu0yDQ
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1af3f00d18991dfab2f695c6f0370d3efd4991e8b42ea54805681f3d7e8942f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 22 Sep 2019 01:38:09 GMT
x-content-type-options
nosniff
server
cafe
age
405758
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
80539
x-xss-protection
0
expires
Sun, 29 Sep 2019 01:38:09 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=43&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatDfpSlotId=siderail_0&zMoatRendered=4&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=3&zMoatPageDataTargetingSet=4&zMoatSafetyTargetingSet=4&zMoatEmptySlot=2&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=562270412&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:47 GMT
p-Jjy-Cyr1NZGRz.gif
pixel.quantserve.com/pixel/
35 B
494 B
Image
General
Full URL
https://pixel.quantserve.com/pixel/p-Jjy-Cyr1NZGRz.gif?labels=_campaign.media.Advertiser%20ID.4552798968.Campaign%20ID.2532006886.Line%20Item%20ID.5046264854
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.189 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:47 GMT
Server
QS
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A47.908Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&sID=4ea737e7-3bac-4c95-ba52-09e6820a12b9&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2532006886%2C%22creativeId%22%3A138268321125%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5046264854%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522047907%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:47 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
truncated
/ Frame 377D
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
51564f046b478e28299ea34d79ae052a54ff8ac60940f0cdd3035c05b70fd698

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A47.960Z&_t=slot_loaded&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&sID=4ea737e7-3bac-4c95-ba52-09e6820a12b9&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2532006886%2C%22creativeId%22%3A138268321125%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5046264854%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522047907%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1569522047960%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:48 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
view
securepubads.g.doubleclick.net/pcs/ Frame B785
0
64 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssFM_AIyY-82Yy76bpTGWZ_FjjFn_8wms8Pv-9LQcfBgtnaUjRGWclHJl1zyiwIs7DTq1XvgQzd42jHR-R7nNdCNLa3skDeTvTscHLRG-xjFjdzwvk0dhnfJEyY5LfS8bkdxj5uMuubYtGItPAM5iVqODxaKQ896XFvmFeUpFEW5xqxl1OszVtwg0YMjc0uVa2ADk29REO18QgBKI5glZ61GoH7ktEsDDH8PWBd_b76I2xRTj-6pyXBfMdQa8ebnnQNej6tJiYXUIzne-vTwohXCsu8pXZk1_eRF4q_o8HXsNRPwg&sig=Cg0ArKJSzG8D7EFHJofSEAE&adurl=
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Sep 2019 18:20:48 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
window_focus.js
tpc.googlesyndication.com/pagead/js/r20190924/r20110914/client/ Frame B785
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20190924/r20110914/client/window_focus.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d31b12baad65082a7d404da9971cc9fed871e35f29a5893f815f468f1050491f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Sep 2019 13:57:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
188595
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1044
x-xss-protection
0
server
cafe
etag
16885093947315342629
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 08 Oct 2019 13:57:33 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame B785
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6182dfae0694d2f06ce0ba9e18b21af30bdc62b4878767761059e6f03cba08e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569237451959804"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
29692
x-xss-protection
0
expires
Thu, 26 Sep 2019 18:20:48 GMT
l
www.google.com/ads/measurement/ Frame B785
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTBi6SwdL3apFOcacJd-U6id2TMTAc4_FYOnqdKo9lexmCraqJYMf8zZMKMg6tc0-32DCftY5NUadqpC96VZZ362SwZjQ
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

moatad.js
z.moatads.com/condenastdfp9588492144/ Frame B785
297 KB
99 KB
Script
General
Full URL
https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
0018ca8c16b5f2b4a5b90fbdf2a7f9efe679564ecbc13b37fdbc73f44118606f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:48 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:35:01 GMT
Server
AmazonS3
x-amz-request-id
639B29FE24B49EB3
ETag
"2d31e9923188682b1c63d504e9908fc1"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=54943
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
100930
x-amz-id-2
HIs4QpCnBui/IprT2fzBJH0sNycsABuS/+9xV1xEGoOlhbLT2VcAQGFedHbIqEXmz2ORmBAMl9w=
8656371344779684667
tpc.googlesyndication.com/simgad/ Frame B785
100 KB
100 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/8656371344779684667
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019091901.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d5464dc12f234c8058db30aa142f546f5b7c8e8a9517d95f2af86bc68b9d2167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Sep 2019 04:00:10 GMT
x-content-type-options
nosniff
age
1174838
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
102708
x-xss-protection
0
last-modified
Tue, 27 Aug 2019 18:03:05 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 12 Sep 2020 04:00:10 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=43&t=1569522045755&de=214026058159&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=7392b0f-clean&zMoatDfpSlotId=post_nav_0&zMoatRendered=5&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=4&zMoatPageDataTargetingSet=5&zMoatSafetyTargetingSet=5&zMoatEmptySlot=2&zMoatNadoDataLoadTime=527&zMoatAllDataLoadTime=527&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&ac=1&bq=11&f=0&zn=0&if=527&na=1002735699&cs=0
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:48 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:48 GMT
p-Jjy-Cyr1NZGRz.gif
pixel.quantserve.com/pixel/
35 B
292 B
Image
General
Full URL
https://pixel.quantserve.com/pixel/p-Jjy-Cyr1NZGRz.gif?labels=_campaign.media.Advertiser%20ID.4552798968.Campaign%20ID.2593538833.Line%20Item%20ID.5157593682
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.189 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:48 GMT
Server
QS
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A48.113Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&sID=4ea737e7-3bac-4c95-ba52-09e6820a12b9&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2593538833%2C%22creativeId%22%3A138285540387%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5157593682%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22970x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522048113%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:48 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
truncated
/ Frame B785
210 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5d495c3fc29d2c9d52fd59bfc5818ab9043d052984146cc5454f0e72577cd8b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A48.154Z&_t=slot_loaded&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&sID=4ea737e7-3bac-4c95-ba52-09e6820a12b9&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2593538833%2C%22creativeId%22%3A138285540387%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5157593682%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22970x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522048113%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1569522048154%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:48 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
cs.js
sb.scorecardresearch.com/c2/6035094/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/6035094/cs.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.43.115.95 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-43-115-95.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Sun, 29 Sep 2019 18:20:48 GMT
adsct
analytics.twitter.com/i/
31 B
434 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1o49&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
125
pragma
no-cache
last-modified
Thu, 26 Sep 2019 18:20:48 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
27c76ec5444851faa0270fea794accd8
x-transaction
00fd61a00076ea18
expires
Tue, 31 Mar 1981 05:00:00 GMT
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-securit...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1569522048257%26pid%3D434737%26url%3Dhttps%253A%252F%252Farstechnica.com%252Finformation-technol...
  • https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-securit...
0
87 B
Script
General
Full URL
https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&fmt=js&s=1&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:48 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
20
x-li-uuid
Hv280vwPyBUQrRqStioAAA==

Redirect headers

date
Thu, 26 Sep 2019 18:20:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
vary
Accept-Encoding
content-length
20
x-li-uuid
v1Vlz/wPyBXAdtl61SoAAA==
server
Play
pragma
no-cache
x-li-pop
prod-edc2-nkernB
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect/?time=1569522048257&pid=434737&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&fmt=js&s=1&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
www.facebook.com/tr/
44 B
248 B
Image
General
Full URL
https://www.facebook.com/tr/?id=228464857488266&ev=Spire-Studio-Segment&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&rl=&if=false&ts=1569522048279&cd[code]=&sw=1600&sh=1200&v=2.9.4&r=stable&ec=2&o=30&fbp=fb.1.1569522048279.394435993&it=1569522046290&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:48 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Thu, 26 Sep 2019 18:20:48 GMT
collect
www.google-analytics.com/r/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/r/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
event
condenast.demdex.net/
6 KB
6 KB
XHR
General
Full URL
https://condenast.demdex.net/event?_ts=1569522048306
Requested by
Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.119.187 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-50-119-187.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ac8d886f0e805386796185122421dc62f78f79c9fa1cfeb64e7af0ee163c9ef9

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v044-0132be248.edge-irl1.demdex.com 5.59.0.20190904135845 26ms (+1ms)
Pragma
no-cache
X-TID
W0HtQ7/gR1M=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://arstechnica.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
5741
Expires
Thu, 01 Jan 1970 00:00:00 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A49.041Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=fd6ef0c9-16e2-4843-b5b7-e127b19854f5&sID=4ea737e7-3bac-4c95-ba52-09e6820a12b9&pID=d75dd492-0a88-458f-8eb6-a66ba8010317&uDt=desktop&aam_uuid=25585191066055673402853426108189879989&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2532006886%2C%22creativeId%22%3A138268321125%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Afalse%2C%22isFirstImpressionViewable%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Afalse%2C%22isFirstMoneyImpressionViewable%22%3Atrue%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5046264854%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522047907%2C%22viewable%22%3A1569522049041%2C%22viewport%22%3A1569522048023%2C%22impression%22%3A1569522047960%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:49 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
activeview
pagead2.googlesyndication.com/pcs/ Frame 377D
42 B
116 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvPw4OHKlgTnb3CGTAJk4silrNH37jjJLKBFCDRtaTqM6tiH0bYvJ6KGqz2AtWVn0Gz6py13reGfG8aSkprWd4Ky3NqeevnLJGZKD64lzo&sig=Cg0ArKJSzC-PirAx00smEAE&adk=1483574547&tt=681&bs=1585%2C1200&mtos=0,1016,1016,1016,1016&tos=0,1016,0,0,0&p=370,1063,620,1363&mcvt=1016&rs=3&ht=0&tfs=1447&tls=2463&mc=0.99&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=1331&niot_cbk=1342&md=2&lm=2&rst=1569522047905&rpt=20&isd=0&msd=0&oseid=3&xdi=0&ps=1585%2C4073&ss=1600%2C1200&pt=1783&bin=1&deb=1-1-3-11-22-13-59-21-0-0-0&tvt=2455&r=v&id=osdim&vs=4&za&uc=11&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20190923
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A49.243Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4100&pSw=1600&pSh=1200&uID=0bfd76bf-92bc-4e7d-8903-8d77c2fdc524&uNw=1&uUq=1&pID=bc74e1f5-f4bb-4453-a800-cbd500b22b40&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.30.3%22%7D&_o=ars-technica&_c=cns_ads&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4552798968%2C%22campaignId%22%3A2593538833%2C%22creativeId%22%3A138285540387%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Afalse%2C%22isFirstImpressionViewable%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Afalse%2C%22isFirstMoneyImpressionViewable%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A5157593682%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22970x250%22%2C%22slug%22%3A%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%7D&dim3=%7B%22footerStart%22%3A1569522045666%2C%22headerStart%22%3A1569522045651%2C%22navigationStart%22%3A1569522044503%2C%22pubAdsReady%22%3A1569522046087%2C%22injected%22%3A1569522048113%2C%22viewable%22%3A1569522049243%2C%22viewport%22%3A1569522048227%2C%22impression%22%3A1569522048154%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%22moat_safe%22%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.30.3%22%5D%2C%22ctx_page_slug%22%3A%5B%22malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%22%5D%2C%22cnt_tags%22%3A%5B%22android-malware%22%2C%22google-play%22%2C%22malvertising%22%2C%22symantec%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_topic_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22google_play%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22cond%C3%A9_nast%22%2C%22ars_orbital_transmission%22%2C%22play_security%22%2C%22media_group%22%2C%22ars_technica_addendum%22%2C%22cnmn_collection%22%2C%22ar%22%5D%2C%22vnd_4d_ctx_ent_sc%22%3A%5B%220.9728098695643983%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4262655563753217%22%2C%220.38238193534477943%22%2C%220.3608614728942603%22%2C%220.3531209275778933%22%2C%220.32219766980829595%22%2C%220.3125845959678489%22%2C%220.3083918905374766%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22configuration_file%22%2C%22google_play%22%2C%22app%22%2C%22advertisement%22%2C%22application%22%2C%22page_layout%22%2C%22symantec%22%2C%22pop-up_ad%22%2C%22malware%22%2C%22android%22%2C%22sean_gallagher%22%2C%22developer%22%2C%22blur%22%2C%22utc%22%2C%22ying_tee%22%2C%22martin_zhang%22%2C%22source_code%22%2C%22threat_intelligence%22%2C%22user%22%2C%22security_screening%22%5D%2C%22vnd_4d_ctx_kw_sc%22%3A%5B%221%22%2C%220.9728098695643983%22%2C%220.9391706607221941%22%2C%220.8689376632349042%22%2C%220.8335926704306043%22%2C%220.8313178034880604%22%2C%220.780952323529197%22%2C%220.7759391555315382%22%2C%220.7175649848767263%22%2C%220.684951539440102%22%2C%220.662913575568928%22%2C%220.5539613931194098%22%2C%220.510250372928262%22%2C%220.4731822803665317%22%2C%220.47175738229643993%22%2C%220.4680546688645307%22%2C%220.46530700375999895%22%2C%220.463078253235087%22%2C%220.4609739116050188%22%2C%220.45091407169070846%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22112200%22%2C%22120000%22%2C%22121100%22%2C%22131100%22%2C%22112221%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%220lw01o%22%2C%22wmhp4i%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22edmh3jrtlez%22%5D%2C%22ctx_advertisers%22%3A%5B%221454517775%22%5D%2C%22ctx_line_items%22%3A%5B%224736014287%22%5D%2C%22ctx_creatives%22%3A%5B%22138237302059%22%5D%2C%22vnd_4d_sid%22%3A%5B%22bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%22%5D%2C%22vnd_4d_pid%22%3A%5B%22e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%22%5D%2C%22vnd_4d_xid%22%3A%5B%224b35fe76-c1f9-448c-943b-db0afdfd250c%22%5D%2C%22vnd_ars_data%22%3A%5B%22100k_pvs%22%5D%7D&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:49 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
activeview
pagead2.googlesyndication.com/pcs/ Frame B785
42 B
116 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssQqsgGI5PRhnoF-tDIUPJIVotBhhYkOkWy-1GQJmVlr1xmJuTMYSmDX1T3puJ1lBWw7DP3hwCfXhJjn47l0jkfsBey03lY4_eciEOXq7E&sig=Cg0ArKJSzMBRGbItQ8uWEAE&adk=2385402828&tt=884&bs=1585%2C1200&mtos=1017,1017,1017,1017,1017&tos=1017,0,0,0,0&p=0,308,250,1278&iza=1&mcvt=1017&rs=3&ht=0&tfs=1650&tls=2667&mc=1&lte=1&bas=0&bac=0&met=no&la=1&avms=nio&niot_obs=1536&niot_cbk=1549&md=2&lm=2&rst=1569522048110&rpt=21&isd=0&msd=0&oseid=3&xdi=0&ps=1585%2C4073&ss=1600%2C1200&pt=1783&bin=1&deb=1-1-3-12-24-13-65-23-0-0-0&tvt=2658&r=v&id=osdim&vs=4&za&uc=11&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=970x250&itpl=3&v=20190923
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
events
wren.condenastdigital.com/1.0/conde/
0
732 B
Other
General
Full URL
https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.242.81 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-242-81.compute-1.amazonaws.com
Software
nginx/1.15.8 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Thu, 26 Sep 2019 18:20:49 GMT
x-content-type-options
nosniff
Server
nginx/1.15.8
x-frame-options
DENY
x-download-options
noopen
vary
origin
Connection
keep-alive
Content-Type
image/gif
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=15768000; preload
x-xss-protection
1; mode=block
ads
pubads.g.doubleclick.net/gampad/ Frame 3191
9 KB
2 KB
XHR
General
Full URL
https://pubads.g.doubleclick.net/gampad/ads?sz=640x480|480x70&iu=/3379/conde.ars/player/information-technology/article&ciu_szs=300x60&gdfp_req=1&env=vp&output=vmap&unviewed_position_start=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.30.3%26ctx_page_slug%3Dmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%26cnt_tags%3Dandroid-malware%252Cgoogle-play%252Cmalvertising%252Csymantec%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_topics%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_topic_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_entities%3Dgoogle_play%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Ccond%25C3%25A9_nast%252Cars_orbital_transmission%252Cplay_security%252Cmedia_group%252Cars_technica_addendum%252Ccnmn_collection%252Car%26vnd_4d_ctx_ent_sc%3D0.9728098695643983%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4262655563753217%252C0.38238193534477943%252C0.3608614728942603%252C0.3531209275778933%252C0.32219766980829595%252C0.3125845959678489%252C0.3083918905374766%26vnd_4d_ctx_keywords%3Dconfiguration_file%252Cgoogle_play%252Capp%252Cadvertisement%252Capplication%252Cpage_layout%252Csymantec%252Cpop-up_ad%252Cmalware%252Candroid%252Csean_gallagher%252Cdeveloper%252Cblur%252Cutc%252Cying_tee%252Cmartin_zhang%252Csource_code%252Cthreat_intelligence%252Cuser%252Csecurity_screening%26vnd_4d_ctx_kw_sc%3D1%252C0.9728098695643983%252C0.9391706607221941%252C0.8689376632349042%252C0.8335926704306043%252C0.8313178034880604%252C0.780952323529197%252C0.7759391555315382%252C0.7175649848767263%252C0.684951539440102%252C0.662913575568928%252C0.5539613931194098%252C0.510250372928262%252C0.4731822803665317%252C0.47175738229643993%252C0.4680546688645307%252C0.46530700375999895%252C0.463078253235087%252C0.4609739116050188%252C0.45091407169070846%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C112200%252C120000%252C121100%252C131100%252C112221%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252C0lw01o%252Cwmhp4i%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cedmh3jrtlez%26ctx_advertisers%3D1454517775%26ctx_line_items%3D4736014287%26ctx_creatives%3D138237302059%26vnd_4d_sid%3Dbffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7%26vnd_4d_pid%3De6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43%26vnd_4d_xid%3D4b35fe76-c1f9-448c-943b-db0afdfd250c%26vnd_ars_data%3D100k_pvs%26height%3D304%26muted%3D0%26right_rail%3D0%26sensitive%3D0%26series%3D5c82bd18bcdfff6f1f2fc5e7%26width%3D540&correlator=1666555318833230&description_url=https%3A%2F%2Fthescene.com%2Fwatch%2Farstechnica%2Fwar-stories-civilization&vid=5d826c83bcdfff482d6d06b0&cmsid=1495&ppid=4b35fe76c1f9448c943bdb0afdfd250c
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
b63763522394b071ff7affba3818f4b0f7e05a621b1098754137625c01f28f47
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 18:20:50 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1736
x-xss-protection
0
google-lineitem-id
0
pragma
no-cache
server
cafe
google-creative-id
0
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A50.187Z&_c=timedOut&_t=gptData&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&dim1=%7B%22adBlocked%22%3Afalse%2C%22adUnits%22%3A%5B%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fars.dart%2Finformation-technology%22%2C%223379%2Fars.dart%2Finformation-technology%22%5D%2C%22embedLocation%22%3A%22arstechnica%22%2C%22error%22%3A%22%22%2C%22lineItems%22%3A%5B%224736014287%22%5D%2C%22publicaEnabled%22%3Afalse%2C%22videoId%22%3A%225d826c83bcdfff482d6d06b0%22%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:50 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
collect
www.google-analytics.com/r/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/r/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 26 Sep 2019 18:20:50 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://arstechnica.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
moatvideo.js
z.moatads.com/condenastjsvideocontent160527792519/ Frame 3191
282 KB
94 KB
Script
General
Full URL
https://z.moatads.com/condenastjsvideocontent160527792519/moatvideo.js
Requested by
Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-7c53e77591569f053696.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f578c7cb24d91598b1310fa28c1c56d3523bbe20e400765ac0b198f1348902ba

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:36:04 GMT
Server
AmazonS3
x-amz-request-id
255223805F5CDEB9
ETag
"150a46b78540ca217b182cac085d330e"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=54973
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95993
x-amz-id-2
OW/YVQ/uIgA45HpgZNoMvuSdSiuQORB2CVjs/rzbT/GQsHfz+SciuW1Z3nJR+AWqX9jcB8Ik0xI=
track
capture.condenastdigital.com/ Frame 3191
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_o=cne&_ts=2019-09-26T18%3A20%3A50.289Z&_c=Video%20Ad&_t=Ad%20Call%20Made&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fvideo.arstechnica.com%2Fwatch%2Fwar-stories-civilization%2F&cId=5d826c83bcdfff482d6d06b0&cKe=&cPd=2019-09-23T15%3A00%3A00%2B00%3A00&cTi=Civilization%3A%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories&cTy=%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle&mDu=734&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pID=e6deb4c2-ee4a-47e6-b66c-b05bb5e2bc43&pWw=540&pWh=303.75&sID=bffdbec8-553c-44d6-b0f7-a3fd0ebc1ee7&uId=7ac9f4c3-68b8-4a38-b214-716bdbf8f159&xid=4b35fe76-c1f9-448c-943b-db0afdfd250c&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22guid%22%3A%223861d2e2-d4b4-749f-9184-a38950e122ff%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A2645.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=&pageType=article%7Creport
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:50 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CONDEVIDEOCONTENT1&hp=1&wf=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1569522050318&de=112621544123&m=0&ar=0b3fb4a610-clean&iw=c61f9aa&q=11&cb=0&ym=0&cu=1569522050318&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=Civilization_%20It%27s%20good%20to%20take%20turns%20%7C%20War%20Stories%3A%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&zMoatVideoId=5d826c83bcdfff482d6d06b0&zMoatAP=-&qs=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&id=1&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&gw=condenastjsvideocontent160527792519&fd=1&ac=1&it=500&ti=0&ih=1&fs=171337&na=1028343131&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Sep 2019 18:20:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 26 Sep 2019 18:20:50 GMT
events
wren.condenastdigital.com/1.0/conde/
0
732 B
Other
General
Full URL
https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg
Requested by
Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.242.81 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-242-81.compute-1.amazonaws.com
Software
nginx/1.15.8 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Thu, 26 Sep 2019 18:20:51 GMT
x-content-type-options
nosniff
Server
nginx/1.15.8
x-frame-options
DENY
x-download-options
noopen
vary
origin
Connection
keep-alive
Content-Type
image/gif
access-control-allow-origin
https://arstechnica.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=15768000; preload
x-xss-protection
1; mode=block
track
capture.condenastdigital.com/
48 B
48 B
Image
General
Full URL
https://capture.condenastdigital.com/track?_ts=2019-09-26T18%3A20%3A52.826Z&_t=timespent&cBr=Ars%20Technica&cKe=Android%20malware%7Cgoogle%20play%7Cmalvertising%7CSymantec&cCh=information%20technology&cTi=Google%20Play%20apps%20laden%20with%20ad%20malware%20were%20downloaded%20by%20millions%20of%20users&cTy=article%7Creport&cTp=ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192%2C%20ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_6%2C%20ALLBRANDS_291%2C%20ALLBRANDS_265%2C%20ALLBRANDS_236&cTpw=0.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.40293681851524876%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.2164885194533358%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716%2C%200.10342870187469716&cEnt=google%20play%2C%20page%20layout%2C%20symantec%2C%20pop-up%20ad%2C%20malware%2C%20android%2C%20sean%20gallagher%2C%20blur%2C%20utc%2C%20ying%20tee%2C%20martin%20zhang%2C%20source%20code%2C%20threat%20intelligence%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20play%20security%2C%20media%20group%2C%20ars%20technica%20addendum%2C%20cnmn%20collection%2C%20ar&cEnw=0.9728098695643983%2C%200.8313178034880604%2C%200.780952323529197%2C%200.7759391555315382%2C%200.7175649848767263%2C%200.684951539440102%2C%200.662913575568928%2C%200.510250372928262%2C%200.4731822803665317%2C%200.47175738229643993%2C%200.4680546688645307%2C%200.46530700375999895%2C%200.463078253235087%2C%200.4262655563753217%2C%200.38238193534477943%2C%200.3608614728942603%2C%200.3531209275778933%2C%200.32219766980829595%2C%200.3125845959678489%2C%200.3083918905374766&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&cCl=467&cId=1575179&cPd=2019-09-26T14%3A41%3A10.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions&pRt=referral&pHp=%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4400&pSw=1600&pSh=1200&uID=d79378e9-81e8-44ce-96fb-a0ce3587ab04&uNw=1&uUq=1&pID=29d033d7-1fae-44a6-a082-3d356bbb4bd2&uDt=desktop&dim1=v1.0.25_iframe_query&_o=ars-technica&_c=general&xID=4b35fe76-c1f9-448c-943b-db0afdfd250c&_v=5000&cKh=configuration%20file%2Cgoogle%20play%2Capp%2Cadvertisement%2Capplication%2Cpage%20layout%2Csymantec%2Cpop-up%20ad%2Cmalware%2Candroid%2Csean%20gallagher
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.111.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-213-111-171.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 26 Sep 2019 18:20:53 GMT
Connection
keep-alive
Content-Length
48
Content-Type
image/gif
cdb
bidder.criteo.com/
0
213 B
XHR
General
Full URL
https://bidder.criteo.com/cdb?ptv=74&profileId=154&cb=68638575289
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
https://arstechnica.com
date
Thu, 26 Sep 2019 18:20:56 GMT
access-control-allow-credentials
true
server
Finatra
timing-allow-origin
*
vary
Origin
cdb
bidder.criteo.com/
0
213 B
XHR
General
Full URL
https://bidder.criteo.com/cdb?ptv=74&profileId=154&cb=50489847568
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
https://arstechnica.com
date
Thu, 26 Sep 2019 18:20:56 GMT
access-control-allow-credentials
true
server
Finatra
timing-allow-origin
*
vary
Origin
/
srv-2019-09-26-18.pixel.parsely.com/plogger/
43 B
229 B
Image
General
Full URL
https://srv-2019-09-26-18.pixel.parsely.com/plogger/?rand=1569522057994&plid=76784862&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22parsely_uuid%22%3A%2206e1025f-bcc1-40ac-b4cb-c85bb9808289%22%2C%22parsely_site_uuid%22%3A%22b702a1b8-3f42-42c0-9a3f-030266f0ed98%22%7D&sid=1&surl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2019%2F09%2Fmalicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions%2F&sref=&sts=1569522057994&slts=0&date=Thu+Sep+26+2019+20%3A20%3A57+GMT%2B0200+(Central+European+Summer+Time)&action=heartbeat&inc=5&tt=4900&pvid=15138380&u=b702a1b8-3f42-42c0-9a3f-030266f0ed98
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.171.99.132 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-171-99-132.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Sep 2019 18:20:58 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
api.rlcdn.com
URL
https://api.rlcdn.com/api/identity?pid=2&rt=envelope
Domain
mid.rkdms.com
URL
https://mid.rkdms.com/ids?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CONDENAST

Verdicts & Comments Add Verdict or Comment

197 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| ars object| digitalData object| dataLayer object| googletag object| cns object| sparrowQueue object| cnBus function| moatYieldReady object| _perfRefForUserTimingPolyfill object| __core-js_shared__ object| core object| fastdom object| BOOMR_mq object| CN object| apstag object| headertag object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken boolean| apstagLOADED undefined| ct undefined| et undefined| hourElapsed undefined| msg undefined| pixelDomain undefined| isDomless undefined| documentReferrer undefined| pxSrc undefined| px object| Moat#G26 object| MoatSuperV26 object| MoatNadoAllJsonpRequest_49466371 boolean| Moat#EVA object| moatPrebidApi object| google_tag_manager object| Twig object| Arrive function| FPCountdown function| $ function| jQuery function| moment function| UAParser function| purl function| twig function| EvEmitter function| imagesLoaded function| easydropdown function| m function| transitionEnd string| $queryString function| arsVideoModulePlayerReady29077522 function| e object| visitor function| Visitor object| s_c_il number| s_c_in function| DIL object| dilInstance string| referrer object| urlParams string| queryString string| fullUrl object| myParam string| GoogleAnalyticsObject function| ga object| _qevents object| __adIq_Config string| b object| h object| _aam_dataLayer undefined| userId boolean| _aam_spa function| fbq function| _fbq function| twq function| getVisitNumCustom number| d string| _linkedin_partner_id object| _linkedin_data_partner_ids object| AIM function| snaptr object| r function| addPixel undefined| google_measure_js_timing boolean| google_noFetch number| __google_ad_urls_id function| gotSegmentData object| _satellite object| ActionButton number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal object| __SKIM_JS_GLOBAL__ object| skimlinksAPI object| _cne function| __cmp object| google_tag_data object| gaplugins object| PolarConde object| NATIVEADS object| NATIVEADS_QUEUE string| hash object| OBR string| OB_releaseVer function| OBR$ object| outbrain object| outbrain_rater function| s_doPlugins function| s_getLoadTime function| AppMeasurement function| s_gi function| s_pgicq object| s string| s_loadT number| s_objectID number| s_giq number| vb function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls object| PARSELY object| twttr function| quantserve function| __qc object| ezt object| _qoptions object| bouncex object| SparrowConfigV2 boolean| ab_isEventListenerAddedForWidgetVisible_action-button-react-iframe object| s_i_conde-arstechnica object| gaData object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| SparrowCache function| Sparrow boolean| sparrowInitialize object| _4d object| sparrow object| NATIVEADS_STORE function| reload_campaigns function| setBounceCookie function| getBounceCookie function| setBounceVisitCookie function| getBounceVisitCookie function| clearBounceCookie function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Sailthru object| Criteo function| headertag_render object| rubicontag object| _0x1af7 function| _0x2623 object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| criteo_pubtag function| docReady undefined| a undefined| c function| jsonFeed object| OneTrust object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups function| OptanonWrapper object| auvars string| key number| google_srt function| mb object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator object| closure_lm_182317 object| google object| closure_lm_970747 object| au function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called function| arrive function| unbindArrive function| leave function| unbindLeave

17 Cookies

Domain/Path Name / Value
www.medtargetsystem.com/ Name: DMDSESSID
Value: pt54uu170m083aqqg0k5uadjg5
.arstechnica.com/ Name: _gat_UA-31997-1
Value: 1
.arstechnica.com/ Name: _fbp
Value: fb.1.1569522048279.394435993
.arstechnica.com/ Name: OptanonConsent
Value: groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1%2C0_90183%3A1%2C0_90185%3A1%2C0_90179%3A1%2C0_90181%3A1%2C0_90158%3A1%2C0_90160%3A1%2C0_90187%3A1%2C0_90189%3A1%2C0_90156%3A1%2C0_90167%3A1%2C0_90169%3A1%2C0_90163%3A1%2C0_90165%3A1%2C0_90175%3A1%2C0_90177%3A1%2C0_90171%3A1%2C0_90173%3A1%2C0_90182%3A1%2C0_90184%3A1%2C0_90178%3A1%2C0_90180%3A1%2C0_90159%3A1%2C0_90161%3A1%2C0_90155%3A1%2C0_90186%3A1%2C0_90157%3A1%2C0_90188%3A1%2C0_90166%3A1%2C0_90168%3A1%2C0_90162%3A1%2C0_90164%3A1%2C0_90174%3A1%2C0_90176%3A1%2C0_90170%3A1%2C0_90172%3A1&datestamp=Thu+Sep+26+2019+20%3A20%3A48+GMT%2B0200+(Central+European+Summer+Time)&version=5.2.0
.demdex.net/ Name: demdex
Value: 25585191066055673402853426108189879989
.arstechnica.com/ Name: __gads
Value: ID=5d98ba85184bd3a3:T=1569522047:S=ALNI_MYuf7qByFgGS1R92kBtptC4Clitjg
arstechnica.com/ Name: dmd-f2f97105-bc19-4d18-b463-188d09348b68
Value: e30=
arstechnica.com/ Name: dmd-ahk
Value: 8be3b5a83b
.arstechnica.com/ Name: sID
Value: 4ea737e7-3bac-4c95-ba52-09e6820a12b9
.demdex.net/ Name: dextp
Value: 601-1-1569522047525|771-1-1569522047626|992-1-1569522047727|1123-1-1569522047827|1175-1-1569522047928|1524-1-1569522048028|22052-1-1569522048129|30064-1-1569522048230|575-1-1569522048330
arstechnica.com/ Name: CN_su
Value: bd624aa8-ddd4-4791-81b8-951ca213470b
.arstechnica.com/ Name: _ga
Value: GA1.2.472596231.1569522046
.arstechnica.com/ Name: _parsely_visitor
Value: {%22id%22:%22b702a1b8-3f42-42c0-9a3f-030266f0ed98%22%2C%22session_count%22:1%2C%22last_session_ts%22:1569522047490}
arstechnica.com/ Name: CN_sp
Value: fd6ef0c9-16e2-4843-b5b7-e127b19854f5
.arstechnica.com/ Name: _parsely_session
Value: {%22sid%22:1%2C%22surl%22:%22https://arstechnica.com/information-technology/2019/09/malicious-pop-up-ad-apps-slipped-past-google-play-security-to-reach-millions/%22%2C%22sref%22:%22%22%2C%22sts%22:1569522047490%2C%22slts%22:0}
arstechnica.com/ Name: pID
Value: d75dd492-0a88-458f-8eb6-a66ba8010317
.arstechnica.com/ Name: _gid
Value: GA1.2.870393297.1569522047

1 Console Messages

Source Level URL
Text
console-api warning URL: https://connect.facebook.net/en_US/fbevents.js(Line 24)
Message:
[Facebook Pixel] - Duplicate Pixel ID: 228464857488266.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4d.condenastdigital.com
a.ad.gt
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
ak.sail-horizon.com
ampcid.google.com
ampcid.google.de
analytics.twitter.com
api.cnevids.com
api.rlcdn.com
api.skimlinks.mgr.consensu.org
arstechnica.com
as-sec.casalemedia.com
assets.adobedtm.com
assets.bounceexchange.com
bidder.criteo.com
bw-prod.plrsrvcs.com
c.amazon-adsystem.com
capture.condenastdigital.com
cdn.accelerator.arsdev.net
cdn.arstechnica.net
cdn.mediavoice.com
cm.everesttech.net
cm.g.doubleclick.net
code.jquery.com
condenast.demdex.net
connect.facebook.net
d.turn.com
d1z2jf7jlzjs58.cloudfront.net
d2c8v52ll5s99u.cloudfront.net
dp8hsntg6do36.cloudfront.net
dpm.demdex.net
dwgyu36up6iuz.cloudfront.net
embed.actionbutton.co
fastlane.rubiconproject.com
geolocation.onetrust.com
ids.ad.gt
image2.pubmatic.com
images.outbrainimg.com
imasdk.googleapis.com
infinityid.condenastdigital.com
js-sec.indexww.com
log.outbrainimg.com
match.adsrvr.org
mb.moatads.com
mcdp-nydc1.outbrain.com
mid.rkdms.com
odb.outbrain.com
optanon.blob.core.windows.net
p.ad.gt
p.skimresources.com
pagead2.googlesyndication.com
pixel.condenastdigital.com
pixel.quantserve.com
pixel.tapad.com
pixels.ad.gt
player.cnevids.com
plugin.mediavoice.com
polarcdn-pentos.com
polarcdn-terrax.com
prod-native.actionbutton.co
pubads.g.doubleclick.net
px.ads.linkedin.com
px.moatads.com
r.skimresources.com
rules.quantcount.com
s.skimresources.com
s0.2mdn.net
sb.scorecardresearch.com
sc-static.net
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
segment-data.zqtk.net
snap.licdn.com
srv-2019-09-26-18.config.parsely.com
srv-2019-09-26-18.pixel.parsely.com
sstats.arstechnica.com
static.ads-twitter.com
static.criteo.net
static.polarcdn.com
stats.g.doubleclick.net
sync.go.sonobi.com
t.co
t.skimresources.com
tag.bounceexchange.com
tcheck.outbrainimg.com
tpc.googlesyndication.com
tr.snapchat.com
widgets.outbrain.com
wren.condenastdigital.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.medtargetsystem.com
z.moatads.com
api.rlcdn.com
mid.rkdms.com
104.17.192.78
104.244.42.131
104.244.42.133
13.32.158.173
13.32.222.190
143.204.208.228
143.204.208.86
143.204.211.231
143.204.214.107
143.204.214.126
143.204.214.13
143.204.214.32
143.204.214.44
151.101.112.157
151.101.112.239
151.101.114.2
151.139.128.10
152.199.22.24
172.217.16.162
178.162.133.149
178.250.2.130
178.250.2.152
185.33.223.209
185.64.189.110
2.18.232.23
2.18.232.28
2.18.234.190
2.18.234.21
2.18.235.40
2001:4de0:ac18::1:a:3a
205.234.175.175
216.58.207.34
23.43.115.95
2600:9000:20bb:7600:11:8cf6:b500:93a1
2600:9000:20bb:fe00:6:44e3:f8c0:93a1
2606:4700:10::6814:b944
2606:4700::6811:4032
2606:4700::6811:dc0f
2606:4700::6813:da83
2606:4700::6813:f87e
2620:119:50e4:101::6cae:b51
2a00:1450:4001:806::2001
2a00:1450:4001:806::200a
2a00:1450:4001:80b::2002
2a00:1450:4001:815::200e
2a00:1450:4001:818::2004
2a00:1450:4001:819::2002
2a00:1450:4001:819::2003
2a00:1450:4001:81a::2008
2a00:1450:4001:81a::200e
2a00:1450:4001:81f::2006
2a00:1450:4001:824::2002
2a00:1450:4001:824::200e
2a00:1450:400c:c08::9a
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.209.40.151
3.213.111.171
3.225.242.81
3.9.50.161
34.230.155.118
34.98.72.95
35.167.98.6
35.171.99.132
35.186.226.184
35.190.40.172
35.190.59.101
35.190.92.63
35.201.67.47
35.227.248.159
46.228.164.13
50.31.169.131
52.1.219.33
52.10.35.234
52.19.1.241
52.212.161.170
52.22.222.12
52.239.137.4
52.43.157.238
52.50.119.187
54.200.217.108
54.236.123.155
54.76.88.219
63.140.41.50
64.202.112.127
64.202.112.31
66.117.28.86
69.173.144.142
91.228.74.183
91.228.74.189
0018ca8c16b5f2b4a5b90fbdf2a7f9efe679564ecbc13b37fdbc73f44118606f
0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c
030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06
032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3
039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15
03ac3d036036cbf3c6fac48afb6bcdde869969afbc1668e9ef5e12a35f75e512
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
0708a8b0556694dae44e3b943cf481a32943a7e56cdb81881cf1cadf69137d34
079a0f28b3d0c3b61c60636496178eec4da6da2a7289540c69c15171a235fb84
08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe
0bee739dd886001c22c29558e21499bbe988f66eb4c0c9b46e42309d04f0aa06
0c0e9dc8fec253f7362e4615301635f8ab97e7c426dcd298f9afa1f01d290c57
0e57eac944064125886efa8d2c1a375b7e50df34923cd900d092bb4a432f3ab3
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10db660a624f80771a66d913adc64a1a5c992546fb5e04e8905d0fd31d7a5ff3
1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16758a4acd30f566e1b0a96b2305b89c354d4aac95a060a669925ecf2977d8dd
16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8
174dec2e7da4b324c72c1d5fd1591832b170024d71fec278f94554452cea9f53
1a7d1a4075cbd1121f65a26404cfc3c8534ed2cee39395695b0125f9381e560f
1af3f00d18991dfab2f695c6f0370d3efd4991e8b42ea54805681f3d7e8942f6
1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012
1d60f8e6be6d438948ca73aa671c90cb06c1f922637f7b1b6e83d5dd2fa02bb3
1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be
1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378
20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8
218087ed3854e672a6627b47c86b3a97e1dad722daa9f509fe522b33b01302a2
27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5
27ee41d3fd05096e2e40507d7d1b6edfb71423aaaea35cfe24d0be18b6eeb006
28079e85a27d754124da880e95fd943a109d646537adb51d575e53bbf0c87310
28567b9298df1914ea63e0ea93676032cdb92854a9fb100a29a4890230a9ca90
2d31de5f3c638aa20538227807c5b92d04e9a261e8068d0dc49794fa9d77bbc5
2f0e2d95e318789b840f67b7004cb30985ce2e0ef3ece7507b2b15e8441811a7
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
34281fadc76859e23ccb1d773e88cb5d01b0019ac0d7208fa790e9f21bf34d46
3495e9f8299dc6ef6234bf69cea0e36741cf4613cd8e1d30763105546305999d
363c3daa4bd8685ce2cf33417f7575e6dd7316f51b09c957b62c31b3942a4ae9
394932783730f35682dbdd0827ee70afd0e4208ac0316d8c9199ad9b49605b9d
3a4500b0e55e94614f6abe4c89f14bef00e38e8c1efa799a7b1606e8ad69c06f
3ad61829a2c11519967b8d9e7e243c27e04322551b6ae37bd0c90683ab3c11a0
3bf16831676488c9e6ea4aea8db26893534895101a1244c58afc1e47d713d298
3ce6aa359a1ab6d1a97a7ea066e6be363ba4a8bfbfa78896c7bc790a3db120f2
3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176
42bdeafb737422f24e47f276e1f9b234c68cd6bcf8af8f7dc690cc350d1e4e08
433bdabdad57a971a481ad56d60e2258f985997b4917f0102085d75aba411296
447751905a61c0f566599777b07619b8d9f74c452057d243f2fa2355e1e0907d
4704fca31cd15f83a91c67e58a9acd46cf491d78fb2e2f8a6be760c8ae8cee7f
4868ca91bcd0d492c501ec5b8d44ac78d3e1226977ae14ff598f5efe78751951
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39
4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd
4a64765dec5cd339627825bfc0dab7df162ec8de3588ce7273cda5bdfd414330
4b188a568fa90fa61d4bbe76dd6cf523abe65787e0ac3dc6b5c44db5e823685b
4d2e73fabea4a24a0278320a4920a5766ae7c7c5a11f787e0f31467a253bdddf
4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8
51564f046b478e28299ea34d79ae052a54ff8ac60940f0cdd3035c05b70fd698
5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b
590ea82ecaec9d3178c7123d813a9e2f9a3406001224687585096d6c00f6c57e
59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282
596b76b93c7801ba85fb53f2f6e2281d4dbffc96ddc18bb056e8cb0e94be34fd
5a33ef24aeb697d2d597a863185f7013b37fd040893d4fb85a45282fa929ccff
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a8c7baa92ef22804b8840eef8a0b4c426e13886bd2e130eb25a307f017c056c
5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c
5ab61c8d78ed26c8e63180889524a5bc6112f235470923b7cff8fab807cca98b
5ae2fd1a7f8a75d5c9b9a45cb869d8b4aa4c6f5abae8cee0acb65d2bfd59ffed
5b488a95c177794d76da1b479bf56facc088949a87771cc6e1458651f4dc8974
5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba
5f3af970acfb02db502def3a6f64048851fd68bcb61c619ba969b18497749718
5f760e6eaa1fd8e199a7135ae74692369612ff5de37b99eb63bcb8ee7d615568
6182dfae0694d2f06ce0ba9e18b21af30bdc62b4878767761059e6f03cba08e5
62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
66142e13bbe676019a4a5a291cd5f6b1b9175790f93e771b7179896fd3e67e34
69932e401ffd71025f7e4bd320ea4ade764c87a91c5acd9114e69d2aaaa19615
69a003bbbbc8d36fd065b861145f56b517f85004deb705d960f665de746ccca4
6b45855e4fce0088ab901606ad5a487f324be1950e44fb8c05de7d18ecdbe73e
6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74
6d68ecae0760b7bb2b9d1d2a5da8945322770f5f2c5a3a188b50ebbb013f8953
6d6f482982f8f1a1814e279ff50df4ccc301533ca9655e4d080d6b90ec69d69e
6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a
703c68bc0eb86c90d0c6670ec0547e19a230db953c002879f2a204dd85dd8571
725913eab3460e2955a8ac4ec176f902c7d8d2db60757248b735cbf8698b0749
7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3
76353ba24248a5e199723c62454daf6edad51e9e24f1ff0f50a01884d6eb01e6
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207
7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8
807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752
81e4baa98023df9a9947e91a8310bb46a86d2f512a91ed408f72bda914232a5a
82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377
83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2
8574074952616e0a56e5b72d9634bff0a683d658d09804c10324293811606d22
85cfa513b1371f392e0b08376ad5ca0bbd15a0ac5ceb49912d067854a086ae81
86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a
8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
8fa0f98b337e13021072fb55a23e68a76cc0408a66e7e4adef056dcfb8751a4f
91a43bc2113401f0fbfdb24ec1e22b44005f6eb04520d15c8e552c4d9745a9ad
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
974bf7a9b3f6e256784e9472234ad50ea30a62f927569fe3b48ecfebfa0fbd2c
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab
99ddca22fc298fbc23f9048c7b3b8d87edd49aaa20e3b32ab169f2e859838e5a
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a04cef2e415d691c895cc8edfc1f0b47da2d3b8bbb7a3114337f682a1114dc73
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1b235023f47ff6443e3d54b34363f41f20bc92cf6a72be3e42e9f12fe72ddf6
a1dd63b1924f5c7c67b01fd56d540707e46a4e5a3aae52a526b37d1c041fef61
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a250307d9edcde82e8320ab9d260d8109a168ab6b3a9fe935368734bf66e5cdb
a29b20518a3bb583278ebb330cba43e072795b7009b39f3479819d00f0833064
a4b1778a87595cf9ae9f5895ec53d8d0c7b14bcd2b8e83e97205de93d9e2d302
a5d495c3fc29d2c9d52fd59bfc5818ab9043d052984146cc5454f0e72577cd8b
a6a60bfeca1021496ac984a7e6b7f05f9473db17edcccbc91855b302863bab76
a91d62b47f02a7e638d1749e3791ac328b2dd89dac630578f76e65b1ed91ed89
a99f308a183c461acaf9db9d77e629f83f355deca0215a60cb3bef0519011eca
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ac8d886f0e805386796185122421dc62f78f79c9fa1cfeb64e7af0ee163c9ef9
aece3989759ce8b9a715ba342a604316f14a06ff35d5d4ee0cb5c7dfc8bbecc6
af3ca6fd3881542da03ed9ade1bbf78859140adc3bd3b703d977e3093c6c57fd
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
b14cd57235aeef49871807324c598f69d8437551b2cfd135c8dbb404b2e5ff72
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b63763522394b071ff7affba3818f4b0f7e05a621b1098754137625c01f28f47
b7b0772e3a20ffcda7bca20f04555ad1c1fb4f31837b1263e904f2c6c76b94d7
b89a77801a8876ffddec1c1eb556d814f1301800ba03814886903c630db92cde
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bcb0943fb17ca96b5c4b3de682f243f02322c59bb277abea2d94b8b38f49988f
c1288f37600dbeda8dd44de4f45b39cef9e323a71e6be0bfaab189a17abebd41
c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34
c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
c4b1dd4bb7210351cac5fd51aaf55a2220532739c042c15ae3667aa3d1198079
c77635c1d346c5471d294f59d0c4ef11f71c21f94e82087cbd99984c9aaa3cda
c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f
ca2a9c9b370cb90986b0dd715198e0b4445eea0ca984f520fb988d00b1de6976
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca5bf9816a06a54b2361b4a16e34d69dde1768182c8dcf28d36b5f1c761ad2dc
caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3
d31b12baad65082a7d404da9971cc9fed871e35f29a5893f815f468f1050491f
d5464dc12f234c8058db30aa142f546f5b7c8e8a9517d95f2af86bc68b9d2167
d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701
d61567f55aced52701dab97ae40d4caf75d81c92b51932a03de88020666dc31e
d7aa953d2324b58988b7c3829dd3f8505ae7ac5ea94c76debb7ea9fbf8422172
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de10c14ed6d1a691cf1d50f0b454e4dfc28fe44a11090e105a6fbb8a0376bf3b
de4de18224e2109f2f8ff4ce9a40cb51c6a36724b2df68e8bd6080b8ee3a02d0
ded8aafe08adcc23835de89f62fbee0b98184f32296c7679ab5b5a358f044f63
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0923229dc6c526b6f051474659888a7f7d0abcade19683559ac10e44df1c816
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e605a40726f8df92ab07cd4c781f8299d077c373f5d5a3488e18ae842493c1cb
e63b1da010fd0ae09966d8d1cb1d5a094faebea66a20c21b4f3e1c4c1abadd66
e90e89e353e425b78e1e852b73984818459e4e31482bb38a25cbc00d624d4f06
ec84902ae04cc118d965c577e2ece816abd594431ce66bcef1afd4f745e951fd
ecc03a7d8b5e87752e51b07bd77cff11b55a1d54b349babd827b6388c6606abd
ee9bf356f3439eed2f173cb63dd4e0d35a4d298bbd706828ebcea8f61647d883
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef50fbb6411e721a4ac6d3c69079bee687d754e01216c093c7bdadd279e0b64a
efdbd8582066a12cf45115f1e150d2a8de06bf6b14db3feca98b116efeb9e0bb
f2cf88d3a53228b050cb4e31ad5b4009f98456cb0f62e56eeeb119af1b6dc44e
f39ddd205229b1de9d44fdda230c861a2a7c8eb3a7755772804eff7f93ee7796
f513c914f8f3cf4975bf34937100375c4b4164ec77ec011488b643452f6ae22f
f578c7cb24d91598b1310fa28c1c56d3523bbe20e400765ac0b198f1348902ba
f6df0547927db498a5d72c147e36233ee9d46d5264066aeda29c1c467b77a186
f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d
f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b
fc3bb7c8bfac2d11524767f5561b412a25ebefb85cd5f891a687ead5280f4739
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf