www.zdnet.com Open in urlscan Pro
2a04:4e42:3::444 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Submission: On March 26 via api (March 26th 2020, 4:47:39 pm UTC) from US

Summary HTTP 210 Redirects Links 53 Behaviour Indicators

Summary

This website contacted 34 IPs in 6 countries across 35 domains to perform 210 HTTP transactions. The main IP is 2a04:4e42:3::444, located in Ascension Island and belongs to FASTLY, US. The main domain is www.zdnet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 24th 2020. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	2a04:4e42:3::444 2a04:4e42:3::444	54113 (FASTLY) (FASTLY)
6	152.195.132.202 152.195.132.202	15133 (EDGECAST) (EDGECAST)
1	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY)
9	2a02:26f0:6c0... 2a02:26f0:6c00:181::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	151.101.65.188 151.101.65.188	54113 (FASTLY) (FASTLY)
27	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:3::645 2a04:4e42:3::645	54113 (FASTLY) (FASTLY)
1	2600:9000:20e... 2600:9000:20eb:9800:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02)
2	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST)
3	18.209.91.145 18.209.91.145	14618 (AMAZON-AES) (AMAZON-AES)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff11	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
3	2606:4700::68... 2606:4700::6810:a00d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	64.30.230.22 64.30.230.22	6623 (CBSI-1) (CBSI-1)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
3	13.226.146.86 13.226.146.86	16509 (AMAZON-02) (AMAZON-02)
2	95.101.185.51 95.101.185.51	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	185.33.223.221 185.33.223.221	29990 (ASN-APPNEX) (ASN-APPNEX)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	34.250.145.255 34.250.145.255	16509 (AMAZON-02) (AMAZON-02)
19	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
1	52.31.92.58 52.31.92.58	16509 (AMAZON-02) (AMAZON-02)
1	52.6.27.178 52.6.27.178	14618 (AMAZON-AES) (AMAZON-AES)
1	13.226.155.78 13.226.155.78	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:816::2002	15169 (GOOGLE) (GOOGLE)
10	95.101.185.246 95.101.185.246	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.108.48.175 104.108.48.175	16625 (AKAMAI-AS) (AKAMAI-AS)
2	63.35.59.66 63.35.59.66	16509 (AMAZON-02) (AMAZON-02)
1 1	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
25	2607:f8b0:400... 2607:f8b0:400a:804::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
210	34

43 2a04:4e42:3::444 (Ascension Island)

ASN54113 (FASTLY, US)

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 152.195.132.202 (United States)

ASN15133 (EDGECAST, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY, US)

production-cmp.isgprivacy.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:6c00:181::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6852bd0c.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
364bf6cc.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.188 (United States)

ASN54113 (FASTLY, US)

at.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::645 (Ascension Island)

ASN54113 (FASTLY, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:9800:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.199.23.241 (United States)

ASN15133 (EDGECAST, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.209.91.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-91-145.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff11 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

iicbsi-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:a00d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.30.230.22 (Fremont, United States)

ASN6623 (CBSI-1, US)
PTR: phx2-dw-cbsi-xw-ext-lb.cnet.com

dw.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.146.86 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-146-86.dus51.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.185.51 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-51.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.223.221 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.250.145.255 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-145-255.eu-west-1.compute.amazonaws.com

api.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.92.58 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-92-58.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.27.178 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-27-178.compute-1.amazonaws.com

idx.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.78 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-78.dus51.r.cloudfront.net

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:816::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 95.101.185.246 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-246.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.48.175 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-48-175.deploy.static.akamaitechnologies.com

rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.35.59.66 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-59-66.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2607:f8b0:400a:804::2003 (United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	cbsistatic.com zdnet4.cbsistatic.com zdnet1.cbsistatic.com zdnet3.cbsistatic.com zdnet2.cbsistatic.com	568 KB
28	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	400 KB
25	gstatic.com csi.gstatic.com	2 KB
18	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	98 KB
13	googletagservices.com www.googletagservices.com	347 KB
12	moatads.com z.moatads.com geo.moatads.com	1 MB
7	ampproject.org cdn.ampproject.org	168 KB
7	zdnet.com www.zdnet.com urs.zdnet.com	225 KB
6	viglink.com cdn.viglink.com api.viglink.com	30 KB
6	akstat.io 6852bd0c.akstat.io 364bf6cc.akstat.io	2 KB
6	cbsi.com production-cmp.isgprivacy.cbsi.com at.cbsi.com dw.cbsi.com rev.cbsi.com	14 KB
6	cookielaw.org cdn.cookielaw.org	129 KB
3	amazon-adsystem.com c.amazon-adsystem.com	29 KB
3	google.com 1 redirects adservice.google.com www.google.com	1 KB
3	chartbeat.net ping.chartbeat.net	504 B
3	go-mpulse.net c.go-mpulse.net	53 KB
2	tiqcdn.com tags.tiqcdn.com	41 KB
1	onetrust.com geolocation.onetrust.com	457 B
1	google.de adservice.google.de	839 B
1	rlcdn.com api.rlcdn.com
1	rkdms.com mid.rkdms.com
1	liadm.com idx.liadm.com	406 B
1	adsrvr.org match.adsrvr.org	541 B
1	casalemedia.com as-sec.casalemedia.com Failed	337 B
1	pubmatic.com hbopenbid.pubmatic.com	115 B
1	adnxs.com ib.adnxs.com	1 KB
1	indexww.com js-sec.indexww.com	13 KB
1	google.co.uk adservice.google.co.uk	839 B
1	akamaihd.net iicbsi-a.akamaihd.net	272 B
1	chartbeat.com static.chartbeat.com	14 KB
1	cbsinteractive.com vidtech.cbsinteractive.com	281 KB
0	openx.net Failed cbsi-d.openx.net Failed
0	advertising.com Failed adserver-us.adtech.advertising.com Failed
0	sonobi.com Failed apex.go.sonobi.com Failed
0	trustx.org Failed sofia.trustx.org Failed
210	35

	Domain	Requested by
27	securepubads.g.doubleclick.net	zdnet3.cbsistatic.com securepubads.g.doubleclick.net www.zdnet.com www.googletagservices.com
25	csi.gstatic.com	securepubads.g.doubleclick.net cdn.ampproject.org
16	zdnet1.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
13	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com
12	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.zdnet.com cdn.ampproject.org tpc.googlesyndication.com
10	z.moatads.com	securepubads.g.doubleclick.net
8	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
7	cdn.ampproject.org	securepubads.g.doubleclick.net
7	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
6	pagead2.googlesyndication.com	www.zdnet.com securepubads.g.doubleclick.net
6	zdnet2.cbsistatic.com	www.zdnet.com zdnet3.cbsistatic.com zdnet2.cbsistatic.com
6	cdn.cookielaw.org	www.zdnet.com cdn.cookielaw.org
6	www.zdnet.com	zdnet3.cbsistatic.com
5	6852bd0c.akstat.io	zdnet1.cbsistatic.com
3	api.viglink.com	cdn.viglink.com
3	c.amazon-adsystem.com	zdnet3.cbsistatic.com c.amazon-adsystem.com
3	cdn.viglink.com	tags.tiqcdn.com www.zdnet.com
3	ping.chartbeat.net	www.zdnet.com
3	at.cbsi.com	zdnet3.cbsistatic.com
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
2	geo.moatads.com	z.moatads.com
2	adservice.google.com	securepubads.g.doubleclick.net www.googletagservices.com
2	tags.tiqcdn.com	zdnet2.cbsistatic.com tags.tiqcdn.com
1	364bf6cc.akstat.io	c.go-mpulse.net
1	geolocation.onetrust.com	cdn.cookielaw.org
1	adservice.google.de	www.googletagservices.com
1	googleads.g.doubleclick.net	www.zdnet.com
1	www.google.com	1 redirects
1	rev.cbsi.com	www.zdnet.com
1	api.rlcdn.com	js-sec.indexww.com
1	mid.rkdms.com	js-sec.indexww.com
1	idx.liadm.com	js-sec.indexww.com
1	match.adsrvr.org	js-sec.indexww.com
1	as-sec.casalemedia.com	zdnet3.cbsistatic.com js-sec.indexww.com
1	hbopenbid.pubmatic.com	zdnet3.cbsistatic.com
1	ib.adnxs.com	zdnet3.cbsistatic.com
1	js-sec.indexww.com	zdnet3.cbsistatic.com
1	adservice.google.co.uk	securepubads.g.doubleclick.net
1	dw.cbsi.com	tags.tiqcdn.com
1	iicbsi-a.akamaihd.net	tags.tiqcdn.com
1	static.chartbeat.com	zdnet2.cbsistatic.com
1	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	production-cmp.isgprivacy.cbsi.com	www.zdnet.com
0	cbsi-d.openx.net Failed	zdnet3.cbsistatic.com
0	adserver-us.adtech.advertising.com Failed	zdnet3.cbsistatic.com
0	apex.go.sonobi.com Failed	zdnet3.cbsistatic.com
0	sofia.trustx.org Failed	zdnet3.cbsistatic.com
210	48

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
support.citrix.com
t.co
twitter.com
github.com
www.trustedsec.com
www.ptsecurity.com
www.mdsec.co.uk
www.citrix.com
www.youtube.com
www.cnet.com
cbsi.force.com
www.cbsinteractive.com
www.facebook.com
www.linkedin.com
legalterms.cbsinteractive.com
narratives.zdnet.com
ca.privacy.cbs
cbsi.secure.force.com
academy.zdnet.com
privacy.cbs
onetrust.com

Subject Issuer	Validity	Valid
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2020-01-24` - `2021-06-18`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
sa437gl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-05-17` - `2020-08-19`	2 years	crt.sh
*.isgprivacy.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-10-07` - `2021-10-14`	2 years	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.at.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-12-17` - `2021-12-21`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2020-03-17` - `2022-06-17`	2 years	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2019-12-16` - `2020-12-30`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-01-18` - `2020-07-26`	6 months	crt.sh
*.cbsi.com DigiCert SHA2 High Assurance Server CA	`2017-11-07` - `2021-02-04`	3 years	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
viglink.com Amazon	`2020-01-10` - `2021-02-10`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.liadm.com Amazon	`2019-12-28` - `2021-01-28`	a year	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2017-10-09` - `2020-10-30`	3 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2018-03-12` - `2020-06-14`	2 years	crt.sh

This page contains 15 frames:

Primary Page: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Frame ID: FC3CAB78F16E7DFA8C7301CA9F24FF9B
Requests: 122 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 68E27E7573CDB4BC3E71379957AA6D3D
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunUOoFdLgJCS5FjfQDySwPJJo5Lb5q3NlaQtFc2lxMHth6gSdAQzwdorfnw3kCo2Ajilw2ZgbUDm4Tvj1E2rPnH6Jky6qgpPhZgKE-SDi0svIgZ_S2Q_PahSQ2fAYjT-WUAsIIFc8HhPNr37I3DrL-rjulCVuJD41FGh2Pn5Z4njyEqQfkO7JKz5NQLCXofHdmNNQwylWPFr0tEKQ53IMrtqgbUse9wtyXNtLSEheEXEKZZKfovDJFq5-m3KDMyOYreF6xZjl4&sai=AMfl-YRTkdhv4VMOMH2lqtXgd6Fqmcf0uWqVKZnyZW4iopy3JR8BKm3aHZD0s2zCIYe8qppyevqBj459KtOyyvdI505niYJUYUTTi1CJNZ7s&sig=Cg0ArKJSzAdpt8cQRSAzEAE&urlfix=1&adurl=
Frame ID: ED7EF4B9B627D4A59CF76D30419582B8
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: F05E311DE0278FFAFCD83C9B3E51899D
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv87cMab-EauRfA2AILNV-VJsgUe6MsTqTAM-ohAzRYQdDOwVSzGxZhOeIEbVvJvM2dTk1orRYoOig5Xy70bC85xUGNxNr_xTeUY20iMm7nvOi1jNYzjQE0lHwwIz67qbpgE7TrpAmx_WnxjDaoUa5jzVM0BaXiVbm2NZybgc2ulRYHOT4soYDvrxtwonJOwvo6UlPeYJb9omd1ClVHcz_BbX4qnmQdtZvWsGbhGXLQVvBiOOwL5F3o8bgz_jPMAw0XEmLOwJ-d&sai=AMfl-YRTIJhYs3Y6JWPT5CyX_1VJ0_u1F_FMv0CkchSj9BOGOxaIHWed-uk8IRDnjW9iycWMfvd5R1i9AHKRIQGUz94aEF8ykb7cI6660BVn&sig=Cg0ArKJSzL-OzJfXLuw_EAE&urlfix=1&adurl=
Frame ID: BFB38B626E4589DFC0F461483EFD53A4
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJiH-CgECIUVpVfFkrlhykMZys14BldciXeJe1GiN4zBPEgAjsyMOaxIs8vagOQEvT2HNtYFwUTbvef_3vu5bObNrSbstjNJ7BTANJVDSpWZbRP_b3iFj8JjK1Zc2uUAET3OxMC7IWpcB1SmVk19m2InZ6alF8ugQq1qmLqqXuZP8SCxyH3cpj75CGi7QnW6M-0yT84_nTj22nGcuPpZlvI2JWl9GHJv3qtYBBbBZ9UMEpjSD3OJ-z9dgXW690NKC1TnjlrjuS&sai=AMfl-YRgty2sYIscwRvwJ7x6r6suuhLXhiRdHAfV19YQShtxkOaJb-AudyJAFf0yk2mhvIQDL4DAHhBFBNs7y7M2pVglKkk2gVnXDrKK20ai&sig=Cg0ArKJSzH9PU8IV_VqbEAE&urlfix=1&adurl=
Frame ID: 44AF3ABEDFDBA869D4FF55925A16371D
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOn0zRhK9IxvrrPz7jXwXQogztM2KrEWc_yO12GGnO1EZrrUiPOqXhilCoPQrjcY6kHnp_v5ug9pXssnRHeL6_uKjMsLXXyTwot8vhJdI3JkTBcCNps5ebpB33sxbEMPIE9DkGSqIIVln3Eaf-QayiGXcz9BOA79GmE5dmijKJkIsx2NS9TDfy9fU9d3TYAMxFrS6S7FOkdrNGJB7CfDoQ1WLOOkQHF-ESSv-UMFZyXX4qhga5w89Ysj88cENI0JnCv9yfl8Dg&sai=AMfl-YQ54C2TUkV7T9NW8CiG7xvcFODUlDhXFI5dY855OB962NvyO4nhjLtcAEHsIXK-e1N2AMFYuNrNbFu0FQJ6yV0XB7m4aDGMKR7ZsbuF&sig=Cg0ArKJSzA3kh-iMwbcKEAE&urlfix=1&adurl=
Frame ID: CB54330410CFF038AB645DA542E8BD23
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssKeovFyWILhVZiClcbHB3Cden9sO8yCvk28h6z53dB9SdMXepNsjnPHUDbWeQxJtg8AHTNaIZyC_BXKXzQirBzSYWtC8lTxjOPpmLMdroq8sDMVDH48dZWp0dADkQea_CA2VjDDCGLxUAXvaYu_zKDM32mf2oNPnika25iTX8zdZHxCw7bAiHIFC7xqRpgPR6CVuXJtNZiLDyaMs5DrVehXfn3SEi8mSvINRzGDGhE8B3J3L0cziYwmDu8pOKmHgyf5yzoj3Mt&sai=AMfl-YRg262lbvx9wOacRNrnk9jQEIj6nMx9NM1ldR8vveVpW_QGVTL8ZiJABi9QX6DZLxgQk_cYCYo4McSXzoCMBrFlH-MJlXC6YYMHle9U&sig=Cg0ArKJSzEB_RVx_cLblEAE&urlfix=1&adurl=
Frame ID: 40C6DF14CB9838B7197E18931FA395D6
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNyaZqEXLIwwzvYucjyF2XPq9oXVqc5je3mAblzsJZTLYvuxT-w-cAc_fMicA_c6iGu7d1fc-3KzP4cGG2_AcO_vsAQGupG7-5Qpx37fmc8ACHDO6T7J2fInW3bK_ug4p-fqIEKgoqopzNoxiRn94N1srkhDoR172UKRZbiChBgsdPTzu-BQc---J6Tye9c5xOVEvsyGZUBnTz5Yorv1egJupMORFSv5jcW809M9PyI2X1zskwIH30roeHYgUiwnQ64HbOpOM0&sai=AMfl-YTspdDHDiGHoUQqCGYc4fli_ercpWfLgSNETfpX6yAWOsX8z7kryxt5AWWlEhcDDWmiXp6ABgo8aUT_b_t_2b-G9NbFBMySloZAZe3j&sig=Cg0ArKJSzOIbRTWWiiXOEAE&urlfix=1&adurl=
Frame ID: ABA8E9D8D492886D3488FB95C19062B6
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvY2wyfq8DeYgmA-nwtCvZbL4eHxzk9BYVOV92hqV4Q8Fxr8NAaRn5SY_ZFEPvZLJAeIspOlxZbn0mGNEchBdXm3D2wsAYrUmEtuf4ZDvkM3TKORqVQtWt-NVK6sgi0u-jttmkho_ehAyVMeFHKztZV2tSzOVA8gc50Y_gJngy8E6w5AIhxls2cGV3YezKshmxqgAUi1pEhkU6A1XFbdKpBTGtCDhjd9fRV_ipeCyunl1sdzG8--6Q53xqhOfWn2oLCKTOcvqFc&sai=AMfl-YTL2s55Rp4tgjjTrIVz5b_PL8LmEDWEzQFuXfxJZVMoQ--WHnxYUnwAxJHwShfFmmTEcnLqcknVp5ZujnotnCrq_hyp7rVbUuFY6PUi&sig=Cg0ArKJSzK_ekEaI4g0wEAE&urlfix=1&adurl=
Frame ID: FF08E84F13E2DEB14F94C3C3EBF5F3FC
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu_bXpK-1QBXcxMfjBFNY_4W9vNOl0ta_1cJm1yP2SxTopRk2W9Btfu-JhjR10Q5KYqr0okOX839P-rsWpaRbKmnjVf4IYR6sUHJKysIkFTJtBxTRljPUpwf4V827VveP62yFH2MAP0BufoH03xVTfkFw-UX518WGdquIOHpazN1Zr9CgEsoZhtYMycrfS136jImMwwgPXYFZUztdVdqjfMESLgK-a7JFacBafFo7rsZlqgxaVSLm_zx4iVUy4hEsWHQX2DBpi1&sai=AMfl-YSOuydYqGs0-ql3dgvZtblzkwQmDj3HnLcQn9EFJgLv63rCO5wEzyfEKo5G8ZWQbQ14X4ZYH4egGZmRmpJ5UqG5TCIIQFk6V__q9JNL&sig=Cg0ArKJSzFBjSkWwAi9nEAE&urlfix=1&adurl=
Frame ID: BA6C6210B37A7EDE32EC51A7D3E42ADE
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuhHPQ_vzcR5cgsSQf4n4u28FST-of84DeuZdYIbaTtFRADGv_2n7B-rrI5xbbXyOmfZSdlNNcfMIxOiWLAq5fXjYbud-zJeGe_a7NUzXuDVHOdXj8Lo7jft0gFMi77Rvn6umUD63LoAesQlZNO45lYSRXKb-tFkC0AFjDIUmlXJqcSFJtozvnw3nfefaoOpmo3bcu3qeyQ3YwcRtDwlYgrUsE3Szs8vOlyThYBteotNMKC0RhDkkPFuOGZMn-b13CsG_hCgnCV&sig=Cg0ArKJSzM_zW7D5DonWEAE&urlfix=1&adurl=
Frame ID: 2007BE8071AE6C3F330A9AE658F353AF
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu05kGg8igtp66prnExUqpSFH-TCor493HSjKZt17Ombjlu4K0Bypdx8imVVyRT_BWfSo7zzk2QaCYuDUGlF7mOfS0wCmzqV8dzn7qfohCzP3WfehTVpU0hdRHAQB3nYk0OSy4Tp9a8pHbf5CimgP5IlgcdwKo5k3bJGniQ-ECwkCeNdAiSlAxT_mgl9xFGsSZNizb2rB1aT4pDzWuNXS_izfNpLG0jgycR6N3CkyiU0zupG5gB7tU59pdL52FoaisCqfnHrDDm&sig=Cg0ArKJSzMfAj59ZN77sEAE&urlfix=1&adurl=
Frame ID: 07DCDEB6BE96546E4248163D563752B4
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 4AE1C823D8FE41D0C8167CFBCFE48BD6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 3E8CA809B986479CDAC194B4F4FD5B0E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

VigLink (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:^[^/]*\/\/[^/]*viglink\.com\/api\/|vglnk\.js)/i

Page Statistics

210
Requests

94 %
HTTPS

44 %
IPv6

35
Domains

48
Subdomains

34
IPs

6
Countries

3472 kB
Transfer

10578 kB
Size

3
Cookies

53 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://support.citrix.com/article/CTX267027
Title: security advisory

Search URL Search Domain Scan URL

URL: https://support.citrix.com/article/CTX267679
Title: a support page detailing mitigations

Search URL Search Domain Scan URL

URL: https://t.co/pDZ2lplSBj
Title: https://t.co/pDZ2lplSBj

Search URL Search Domain Scan URL

URL: https://twitter.com/GossiTheDog/status/1214892555306971138?ref_src=twsrc%5Etfw
Title: January 8, 2020

Search URL Search Domain Scan URL

URL: https://t.co/9MOvnSnjUb
Title: https://t.co/9MOvnSnjUb

Search URL Search Domain Scan URL

URL: https://twitter.com/bad_packets/status/1215528919048179712?ref_src=twsrc%5Etfw
Title: January 10, 2020

Search URL Search Domain Scan URL

URL: https://t.co/7B9d7e7YK7
Title: https://t.co/7B9d7e7YK7

Search URL Search Domain Scan URL

URL: https://twitter.com/RGB_Lights/status/1215526650605121537?ref_src=twsrc%5Etfw
Title: January 10, 2020

Search URL Search Domain Scan URL

URL: https://t.co/jeF0UC6A9V
Title: https://t.co/jeF0UC6A9V

Search URL Search Domain Scan URL

URL: https://twitter.com/HackingDave/status/1215800253246513155?ref_src=twsrc%5Etfw
Title: January 11, 2020

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/CVE?src=hash&ref_src=twsrc%5Etfw
Title: #CVE

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/Citrix?src=hash&ref_src=twsrc%5Etfw
Title: #Citrix

Search URL Search Domain Scan URL

URL: https://t.co/KjsUOJQsLt
Title: pic.twitter.com/KjsUOJQsLt

Search URL Search Domain Scan URL

URL: https://twitter.com/0x09AL/status/1215437443375214593?ref_src=twsrc%5Etfw
Title: January 10, 2020

Search URL Search Domain Scan URL

URL: https://github.com/projectzeroindia/CVE-2019-19781
Title: the first proof-of-concept (PoC) exploit code

Search URL Search Domain Scan URL

URL: https://github.com/trustedsec/cve-2019-19781
Title: with their own PoC

Search URL Search Domain Scan URL

URL: https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/
Title: how to analyze Citrix systems for any possible compromise

Search URL Search Domain Scan URL

URL: https://www.ptsecurity.com/ww-en/about/news/citrix-vulnerability-allows-criminals-to-hack-networks-of-80000-companies/
Title: Positive Technologies

Search URL Search Domain Scan URL

URL: https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/
Title: MDSec

Search URL Search Domain Scan URL

URL: https://www.trustedsec.com/blog/critical-exposure-in-citrix-adc-netscaler-unauthenticated-remote-code-execution/
Title: TrustedSec

Search URL Search Domain Scan URL

URL: https://www.citrix.com/blogs/2020/01/11/citrix-provides-update-on-citrix-adc-citrix-gateway-vulnerability/
Title: In a blog post

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=91BDJPk4YIg
Title: How to protect yourself from mobile malware attacks (ZDNet YouTube)

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/best-home-security-systems-for-2020/?ftag=CMG-01-10aaa1b
Title: Best home security of 2020: Professional monitoring and DIY (CNET)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/how-to-setup-secure-credential-storage-for-docker/?ftag=CMG-01-10aaa1b
Title: How to set up secure credential storage for Docker (TechRepublic)

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/highlights
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/downloads/security-awareness-and-training-policy/
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/
Title: CA Privacy/Info We Collect

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/donotsell
Title: CA Do Not Sell My Info

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://privacy.cbs/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 121

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

210 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/ 509 KB
146 KB 173ms
152ms Document
text/html 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e157ca3b91a2c8064ff20afafe5b4ea29405f92c79b9fe3acadf146ea785e5d1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
content-type: text/html; charset=UTF-8
x-tx-id: a1d07f87-273b-42fa-b482-4eab6b982aa6
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
last-modified: Thu, 26 Mar 2020 16:46:40 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
date: Thu, 26 Mar 2020 16:47:01 GMT
cache-control: max-age=5400, private
expires: Thu, 26 Mar 2020 18:16:40 GMT
set-cookie: fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure;
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload
accept-ranges: bytes
content-length: 148197

GET
H2 200 main-016a6e5a2e-rev.css
zdnet4.cbsistatic.com/fly/2030-fly/css/core/ 350 KB
63 KB 36ms
11ms Stylesheet
text/css 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4b4491c17dcd87963bc4a75a5b330aa0030d747a1239a8be9c6d3f13db8efce7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 26 Mar 2020 16:47:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1276
status: 200
strict-transport-security: max-age=31536000
content-length: 64406
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:20:09 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd639-5777f"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:45 GMT

GET
H2 200 controls-59ddd7cdba-rev.css
zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/ 17 KB
4 KB 34ms
8ms Stylesheet
text/css 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-59ddd7cdba-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

328fed03bc54229786055a93d3ec6abc6f7becf99849338cbb881b02c372514b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 26 Mar 2020 16:47:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1276
status: 200
strict-transport-security: max-age=31536000
content-length: 3686
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:20:22 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd646-4411"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:45 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 11 KB
4 KB 3080ms
13ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE8) /
Resource Hash: 8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:04 GMT
content-encoding: gzip
content-md5: N1nkxqP8FRR4U7sOR6dsSg==
age: 14097
x-cache: HIT
status: 200
content-length: 3742
x-ms-lease-status: unlocked
last-modified: Wed, 25 Mar 2020 18:55:08 GMT
server: ECAcc (frc/8FE8)
etag: 0x8D7D0EE09F55024
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 32a175da-301e-0038-7e6d-0399bf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:04 GMT

GET
H2 200 optanon.js Show response
production-cmp.isgprivacy.cbsi.com/dist/ 35 KB
10 KB 37ms
9ms Script
application/x-javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://production-cmp.isgprivacy.cbsi.com/dist/optanon.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

462affeccc8485529f34f0328e9ce8a661b824def972da6dcaaa42d4a2892dde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2210
via: 1.1 varnish
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 10070
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4037-HHN
x-amz-id-2: MSrzbM91tZ8Y+73Z6k5B0Qx1v20lZMWDoE+gifx1/fuVeZOIf06L6sKjfkIrpN55asEZwce1+M4=
last-modified: Tue, 17 Mar 2020 14:48:12 GMT
x-timer: S1585241222.941575,VS0,VE0
x-frame-options: SAMEORIGIN
etag: "5de283c95be843c6ca4d9f2b1b6d5983"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
accept-ranges: bytes
x-cache-hits: 343

GET
H2 200 catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 907 B
1 KB 9ms
7ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2936183
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 865
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"621461af90cadfdaf0e8d4cc25129f91"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 citrix-bug.png
zdnet2.cbsistatic.com/hub/i/2020/01/11/adaeb9ea-e3b8-4799-8295-2f4d23aa7647/ 12 KB
11 KB 225ms
215ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/2020/01/11/adaeb9ea-e3b8-4799-8295-2f4d23aa7647/citrix-bug.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f82e8053fbcd78685d9e26caebeebc38ee73eb9afa4bb36765c50ce6614eebf3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 10847
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"ff3f6b76fcf005c7632abe3eb4df6263"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/js/libs/ 16 KB
6 KB 12ms
9ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 279130
status: 200
strict-transport-security: max-age=31536000
content-length: 6288
x-xss-protection: 1; mode=block
last-modified: Thu, 19 Mar 2020 20:21:40 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e73d454-3f88"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 Mar 2020 11:14:52 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame 68E2 202 KB
51 KB 42ms
16ms Script
application/javascript 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 16:47:02 GMT
Content-Encoding: br
Last-Modified: Tue, 10 Mar 2020 18:04:33 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 51580

GET
DATA 200
OK truncated
/ 31 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 mag-white01.png
zdnet3.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/core/ 1 KB
1 KB 6ms
6ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1276
status: 200
strict-transport-security: max-age=31536000
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:17:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd596-4f1"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:46 GMT

GET
H2 200 logo.png
zdnet3.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/core/ 4 KB
4 KB 7ms
6ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1276
status: 200
strict-transport-security: max-age=31536000
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:17:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd596-1009"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:46 GMT

GET
H2 200 Semibold.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 20ms
6ms Font
font/woff2 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
Origin: https://www.zdnet.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
x-content-type-options: nosniff
age: 2429222
status: 200
strict-transport-security: max-age=31536000
content-length: 20344
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f78"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
H2 200 Regular.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 21ms
7ms Font
font/woff2 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
Origin: https://www.zdnet.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
x-content-type-options: nosniff
age: 2429222
status: 200
strict-transport-security: max-age=31536000
content-length: 20256
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f20"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/2030-fly/js/ 579 KB
185 KB 10ms
10ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

91032730f8c25c27f6be4ef1ac9623d1de5db9ed3fcb5edb18ad65332cfea607

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1275
status: 200
strict-transport-security: max-age=31536000
content-length: 188969
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:20:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd64a-90a73"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:46 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 68E2 2 KB
1 KB 233ms
211ms XHR
application/json 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5284137&v=1.632.0&if=&sl=0&si=y10q0tlwbz-q7t7ye&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 7ce2527966fa13427ad0fe52da9c10bbeaf9b3962999d75337b720977d2ee38d

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 16:47:02 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 761

GET
H2 200 client-info Show response
at.cbsi.com/lib/api/ 99 B
354 B 55ms
12ms Fetch
application/json 151.101.65.188
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://at.cbsi.com/lib/api/client-info

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.188 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Varnish /

Resource Hash

a5f3e41174dfbab395d1b802917ff07caf8d4504b1f63542b925b101f7ccc740

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
via: 1.1 varnish
x-cache: HIT
status: 200
otest: at.cbsi.com
content-length: 99
x-served-by: cache-hhn4058-HHN
server: Varnish
x-timer: S1585241223.538955,VS0,VE0
strict-transport-security: max-age=300
access-control-allow-methods: OPTIONS, POST, GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes
access-control-allow-headers: *
retry-after: 0
x-cache-hits: 0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 44 KB
15 KB 3080ms
22ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

55620583eecd8f9a36a45072edeef72f395acdb8da34d22d9b1f8d599a43c25c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "467 / 533 of 1000 / last-modified: 1585081375"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14669
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:05 GMT

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 1272ms
116ms Script
application/javascript 35.190.38.167
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:03 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 61 KB
13 KB 14ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 517256
status: 200
strict-transport-security: max-age=31536000
content-length: 13447
x-xss-protection: 1; mode=block
last-modified: Thu, 19 Mar 2020 20:21:40 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e73d454-f278"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Mar 2020 17:06:06 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 49ms
34ms XHR
application/json 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1585241222797&s=43d9c0f2ef076b681762686f954e18fa4bcc139d94e1cc809de0f5e34a9b8249
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 07ee3304cd671471764757b5f8bd8275bfb74456f134e7e8ce97ce18c8061318

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 16:47:02 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 779

GET
H/1.1 204
No Content / Show response
6852bd0c.akstat.io/ 0
354 B 74ms
43ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0c.akstat.io/?h.pg=article&when=1585241222800&cdim.Site_View=desktop&t_other=custom9%7C927&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=29eda8f96acb45de8fab983c83e2fac6951471c4&h.t=1585241222831&http.initiator=api&rt.start=api&rt.si=d87471ec-af1d-4890-ac32-58e6c5039e47&rt.ss=1585241223867&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:02 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:02 GMT

GET
H/1.1 204
No Content / Show response
6852bd0c.akstat.io/ 0
354 B 64ms
32ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0c.akstat.io/?h.pg=article&when=1585241222800&cdim.Site_View=desktop&t_other=custom6%7C961&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=29eda8f96acb45de8fab983c83e2fac6951471c4&h.t=1585241222831&http.initiator=api&rt.start=api&rt.si=d87471ec-af1d-4890-ac32-58e6c5039e47&rt.ss=1585241223867&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:02 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:02 GMT

GET
H/1.1 204
No Content / Show response
6852bd0c.akstat.io/ 0
354 B 33ms
32ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0c.akstat.io/?h.pg=article&when=1585241223073&cdim.Site_View=desktop&t_other=custom4%7C184&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=29eda8f96acb45de8fab983c83e2fac6951471c4&h.t=1585241222831&http.initiator=api&rt.start=api&rt.si=d87471ec-af1d-4890-ac32-58e6c5039e47&rt.ss=1585241223867&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:03 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:03 GMT

GET
H2 200 article-4bf1478396-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 148 KB
41 KB 9ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-4bf1478396-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596923
status: 200
strict-transport-security: max-age=31536000
content-length: 41795
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-25039"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:19 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 39ms
8ms Script
application/javascript 2a04:4e42:3::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:3::645 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:03 GMT
content-encoding: gzip
age: 1114563
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: WsZMn1b4DWlY+9ifr3pbbXeD+ey1HoTP0Gb1ZwEp4aFa9pwUhy9bTx9y0SvJM0DhUMGJCX3Bl18=
x-served-by: cache-dca17775-DCA, cache-fra19143-FRA
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1585241224.954249,VS0,VE0
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: 9D1B37F42EBF691F
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 2

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 35 KB
14 KB 27ms
8ms Script
application/x-javascript 2600:9000:20eb:9800:18:1fcd:349:ca21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:9800:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 14:18:24 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 02:24:02 GMT
server: nginx
age: 1720
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: Tg1YFuUZp7bKClmu0bL3aclNE_D3cPZ8KOluockJZaqMjAXVmUizzg==
via: 1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
expires: Thu, 26 Mar 2020 16:18:24 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 147 KB
41 KB 1062ms
8ms Script
text/javascript 152.199.23.241
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FC3) /
Resource Hash: 328d295ac80c1bb34918bfede9952dd43910f71f3feb24e01d852db9a1dc467b

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 15:33:00 GMT
server: ECAcc (frc/8FC3)
age: 91
etag: "3130170944"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 41616
expires: Thu, 26 Mar 2020 16:52:05 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 332ms
114ms Image
image/gif 18.209.91.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&u=DzAnuSprXi_eX7Ex&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=4991&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2701&t=CkRU2NDPuFs8QJUS7D85g-P2LDG5&V=118&i=Proof-of-concept%20code%20published%20for%20Citrix%20bug%20as%20attacks%20intensify%20%7C%20ZDNet&tz=-60&_acct=anon&sn=1&sv=BszTyhC8tOydBRNMXoDjgK3SBkqHfO&sd=1&im=067b2ff3&_
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.91.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-91-145.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
pragma: no-cache
date: Thu, 26 Mar 2020 16:47:04 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 43
content-type: image/gif

GET
H2 200 bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/ 4 KB
2 KB 789ms
10ms XHR
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8EA3) /
Resource Hash: 56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
content-md5: tnKHGc+Hbu8/XNTAD7qBqA==
age: 7163
x-cache: HIT
status: 200
content-length: 2089
x-ms-lease-status: unlocked
last-modified: Sat, 22 Feb 2020 00:49:50 GMT
server: ECAcc (frc/8EA3)
etag: 0x8D7B7311F4659C5
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 37adae7e-501e-0089-7a7d-0361c2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:05 GMT

GET
H/1.1 200
OK isInternalUser.js Show response
iicbsi-a.akamaihd.net/common/js/esi/ 22 B
272 B 63ms
10ms Script
application/x-javascript 2a01:4a0:1338:28::c38a:ff11
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff11 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 16:47:05 GMT
Cache-Control: max-age=120754
Server: AkamaiNetStorage
Connection: keep-alive
ETag: "fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length: 22
Content-Type: application/x-javascript

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
28 KB 70ms
33ms Script
text/javascript 2606:4700::6810:a00d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1456398
status: 200
content-type: text/javascript
content-length: 27746
x-amz-id-2: k+okSOR42zJ+0NXBU9e7GjyX3LnVDI3WyfHKAbO/Li4DV/GDGOBbRpY1uMvq+ZdZAZ2xUfG39SY=
last-modified: Mon, 21 Oct 2019 20:13:23 GMT
server: cloudflare
etag: "df893ab92782cedac4da4785df9ec68e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 0D47E0D8F5A25A84
cache-control: public, max-age=1800
accept-ranges: bytes
cf-ray: 57a259fb8a9f9ac2-FRA
expires: Thu, 26 Mar 2020 17:17:05 GMT

GET
H/1.1 200
OK anonc.js Show response
dw.cbsi.com/ 73 B
620 B 583ms
142ms Script
application/javascript 64.30.230.22
CBSI-1

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/anonc.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1, US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: 22c5d9b429274e16a5f4f847e869cb61173a02b65c0ea748916e38dded6534c5

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 16:47:06 GMT
Server: Apache/2.4.25
Etag: GpABv1583IpEzB6SvNY.1.dw_anonc
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control: private, max-age=43200, s-max-age=0
Connection: Keep-Alive
Content-Type: application/javascript
Keep-Alive: timeout=80, max=810
Content-Length: 73
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
124 B 13ms
13ms Script
text/javascript 152.199.23.241
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/202003231532&cb=1585241225497
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA1) /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
last-modified: Thu, 14 Apr 2016 16:59:33 GMT
server: ECAcc (frc/8FA1)
age: 499658
etag: "2243872957"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Thu, 26 Mar 2020 16:57:05 GMT

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
267 B 23ms
18ms Image
image/gif 2606:4700::6810:a00d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=7.203074685968505
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
cf-cache-status: HIT
age: 12
status: 200
content-type: image/gif
content-length: 43
x-amz-id-2: BqCPjZAPsLbKDpICneWtqUUbPcKoT0de6uFdSMN2JLxel8c9UpfO++gKfB9AINE05qeEB8pFzSM=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 0EAF4E1BA06C19B7
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 57a259fbeb2b9ac2-FRA

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
104 B 22ms
21ms Image
image/gif 2606:4700::6810:a00d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=7.203074685968505
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
cf-cache-status: HIT
age: 12
status: 200
content-type: image/gif
content-length: 43
x-amz-id-2: BqCPjZAPsLbKDpICneWtqUUbPcKoT0de6uFdSMN2JLxel8c9UpfO++gKfB9AINE05qeEB8pFzSM=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 0EAF4E1BA06C19B7
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 57a259fbeb2c9ac2-FRA

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 109 B
839 B 35ms
19ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
323 B 20ms
19ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 167 KB
61 KB 16ms
15ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62290
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:05 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 87 KB
25 KB 303ms
31ms Script
application/javascript 13.226.146.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.146.86 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-146-86.dus51.r.cloudfront.net
Software: Server /
Resource Hash: ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 22:00:55 GMT
content-encoding: gzip
server: Server
age: 67570
etag: 1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: wmTS_79v1_cdeZuG74HfEGU2ivZPjC2-qe_s-3z1q6G6FVW9ROpJ5Q==
via: 1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)

GET
H/1.1 200
OK 183728-122510094381206.js Show response
js-sec.indexww.com/ht/p/ 38 KB
13 KB 1529ms
473ms Script
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a7b65febc438aa5d36606447ccb170f9e78cc712343964f0820b8e3bc235c217

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 16:47:07 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Mar 2020 16:46:15 GMT
Server: Apache
ETag: "da4194-984f-5a1c4b923e07e"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3583
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 13037
Expires: Thu, 26 Mar 2020 17:46:50 GMT

GET hb
sofia.trustx.org/ 0
0

GET trinity.json
apex.go.sonobi.com/ 0
0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 955 B
1 KB 162ms
119ms XHR
application/json 185.33.223.221
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

504c11ffc9c4a8d0fa18d850011e5332cfdff9785e9db66e2650a26cde01fba1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 26 Mar 2020 16:47:07 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 5.254.16.109; 5.254.16.109; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.9:80
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3db00bfc-a914-4e21-b533-751fea427d1c
Server: nginx/1.13.4
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET ADTECH;v=2;cmd=bid;cors=yes;alias=55f54078f7f9756;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110776/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=5684608061838a3;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110771/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=5752136646674cc;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110775/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=58de590010551a3;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110769/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=598458fa1025b4a;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110778/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=60fd54174eab80d;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110784/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=61159c70d921427;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110785/0/0/ 0
0

GET ADTECH;v=2;cmd=bid;cors=yes;alias=626a7681057d25e;misc=1585241225712;
adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110780/0/0/ 0
0

GET arj
cbsi-d.openx.net/w/1.0/ 0
0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 420ms
140ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 26 Mar 2020 16:47:06 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.zdnet.com

GET cygnus
as-sec.casalemedia.com/ 0
0

GET
H/1.1 204
No Content / Show response
6852bd0c.akstat.io/ 0
354 B 98ms
83ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0c.akstat.io/?h.pg=article&when=1585241225721&cdim.Site_View=desktop&t_other=custom7%7C3995&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=29eda8f96acb45de8fab983c83e2fac6951471c4&h.t=1585241222831&http.initiator=api&rt.start=api&rt.si=d87471ec-af1d-4890-ac32-58e6c5039e47&rt.ss=1585241223867&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:05 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:05 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/5.12.0/ 381 KB
92 KB 7164ms
14ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F5C) /
Resource Hash: 37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:12 GMT
content-encoding: gzip
content-md5: 7Kk4zqCmlBKTWyZO1p1w1Q==
age: 7505
x-cache: HIT
status: 200
content-length: 94107
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:32 GMT
server: ECAcc (frc/8F5C)
etag: 0x8D7B70A62368476
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: aaecfefb-901e-0035-757c-0376b3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:12 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 285ms
11ms XHR
application/javascript 13.226.146.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.146.86 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-146-86.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 13:55:57 GMT
content-encoding: gzip
vary: Origin
age: 10270
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 05 Mar 2020 08:28:46 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 0weGRohmHwf5BUvDaI_KP578Nej0q1xAoAshCkSxAhDnD3bJIXhy8A==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
370 B 76ms
75ms XHR
text/javascript 13.226.146.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=3264&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&pid=oa5otRxOt9HFA&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x66%22%5D%2C%22sn%22%3A%22%2F8264%2Fuk-zdnet%2Fsecurity%2Fleader-plus-top%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%5D%2C%22sn%22%3A%22%2F8264%2Fuk-zdnet%2Fsecurity%2Fmpu-plus-top%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F8264%2Fuk-zdnet%2Fsecurity%2Fmpu-middle%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F8264%2Fuk-zdnet%2Fsecurity%2Fmpu-bottom%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x66%22%5D%2C%22sn%22%3A%22%2F8264%2Fuk-zdnet%2Fsecurity%2Fleader-plus-bottom%22%7D%5D&cfgv=0&gdprl=%7B%22status%22%3A%22tcfv2-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.146.86 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-146-86.dus51.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:06 GMT
via: 1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: vzc_o5dKnAMeYESPkP5OkcWwky_KsYLGcGb3Wbbp-RqNq1gxw9RA8w==

POST
H/1.1 200
OK ping Show response
api.viglink.com/api/ 265 B
945 B 157ms
38ms XHR
text/javascript 34.250.145.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/ping
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.145.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-145-255.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 40f39fd13c347ba41bb24d1bf622d4ab73bdc913359f3ca92ebb8f35f7fac77e

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:05 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 265
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 92 B
537 B 34ms
34ms XHR
text/javascript 34.250.145.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.145.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-145-255.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: dfdb21cf6583b14fae51ee166f863a403e5d7da342c3f219a882ebcb7686454e

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:06 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 92
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 190 KB
26 KB 1026ms
710ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2943858184341641&correlator=1787734062105909&output=ldjh&impl=fifs&adsid=NT&eid=21065762%2C21065393&vrg=2020032301&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%7C7x7%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C641x321%2C320x50%7C11x11%2C300x250%2C728x90%7C970x250%7C970x66&fluid=0%2C0%2C0%2C0%2C0%2C0%2Cheight%2C0%2C0&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%26amznbid%3D2%26amznp%3D2%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%26amznbid%3D2%26amznp%3D2%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%26amznbid%3D2%26amznp%3D2%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dtop%26sl%3Dinpage-video-top%253FT-1000%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%26amznbid%3D2%26amznp%3D2%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Centerprise-software%252Cservers%26mfr%3Dcitrix-systems%252Cgithub%26pid%3Dcitrix-netscaler-gateway%26tag%3Dcyber-security%252Ctarget%26prodtype%3Dsoftware%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Duk%26subses%3D3%26session%3Dc%26pv%3D1%26vguid%3D7a61fa7a-4ecb-4aee-af48-67012916ed59&cookie_enabled=1&bc=31&abxe=1&lmt=1585241200&dt=1585241226741&dlt=1585241221907&idt=3757&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C-20%2C1043%2C1043%2C1008%2C208%2C208%2C1043%2C429&adys=0%2C312%2C432%2C2451%2C1650%2C1601%2C2144%2C3333%2C5143&adks=1512325694%2C3581870410%2C1925781520%2C3289239044%2C3970605601%2C2450494987%2C2484431570%2C3509234736%2C519614694&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&dssz=44&icsg=8796093710336&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x5602%7C1585x90%7C370x250%7C370x250%7C370x771%7C770x4257%7C770x11%7C370x250%7C1210x90&msz=1585x5%7C1585x90%7C370x250%7C370x250%7C370x771%7C770x321%7C770x11%7C370x250%7C1210x90&ga_vid=1689556469.1585241227&ga_sid=1585241227&ga_hid=1444872541&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

c3eccb4080509e4a6f99d174b4899b425229f6d7f256d4f0c57f1e269b1bb8aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 26359
x-xss-protection: 0
google-lineitem-id: 4745974454,-1,4745571990,4745571990,4825966980,4745327422,4745189935,4745571990,4745556468
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239360957,-1,138239321475,138248164873,138247024569,138239368367,138239344157,138239321460,138286514475
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 67 KB
25 KB 332ms
17ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25048
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 23ms
7ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H/1.1 204
No Content / Show response
6852bd0c.akstat.io/ 0
354 B 127ms
127ms XHR
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0c.akstat.io/?h.pg=article&when=1585241226725&cdim.Site_View=desktop&t_other=custom8%7C4999&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=29eda8f96acb45de8fab983c83e2fac6951471c4&h.t=1585241222831&http.initiator=api&rt.start=api&rt.si=d87471ec-af1d-4890-ac32-58e6c5039e47&rt.ss=1585241223867&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:06 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:06 GMT

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 99ms
32ms XHR
application/json 52.31.92.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183728
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.92.58 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-92-58.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: aeb3d3e48f39ea28fe85ff4ea9cbc7f668e49b18ceae8fce8e19495ffdbb2e9e

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sat, 25 Apr 2020 16:47:07 GMT

GET
H/1.1 204
No Content any Show response
idx.liadm.com/idex/ie/ 0
406 B 649ms
105ms XHR
text/plain 52.6.27.178
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/ie/any

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.6.27.178 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-27-178.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.zdnet.com
Date: Thu, 26 Mar 2020 16:47:07 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 404 idsv2 Show response
mid.rkdms.com/ 0
0 53ms
15ms XHR
application/xml 13.226.155.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CBSI
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.78 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-78.dus51.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

GET
H2 400 identity
api.rlcdn.com/api/ 0
0 1097ms
47ms XHR
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame ED7E 0
0 19ms
18ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunUOoFdLgJCS5FjfQDySwPJJo5Lb5q3NlaQtFc2lxMHth6gSdAQzwdorfnw3kCo2Ajilw2ZgbUDm4Tvj1E2rPnH6Jky6qgpPhZgKE-SDi0svIgZ_S2Q_PahSQ2fAYjT-WUAsIIFc8HhPNr37I3DrL-rjulCVuJD41FGh2Pn5Z4njyEqQfkO7JKz5NQLCXofHdmNNQwylWPFr0tEKQ53IMrtqgbUse9wtyXNtLSEheEXEKZZKfovDJFq5-m3KDMyOYreF6xZjl4&sai=AMfl-YRTkdhv4VMOMH2lqtXgd6Fqmcf0uWqVKZnyZW4iopy3JR8BKm3aHZD0s2zCIYe8qppyevqBj459KtOyyvdI505niYJUYUTTi1CJNZ7s&sig=Cg0ArKJSzAdpt8cQRSAzEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED7E 74 KB
28 KB 35ms
22ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame ED7E 314 KB
105 KB 37ms
18ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
27 KB 32ms
23ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28015
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame F05E 200 KB
55 KB 70ms
4ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1635
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 16:19:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 16:19:52 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame F05E 200 KB
55 KB 83ms
17ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1635
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 16:19:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 16:19:52 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F05E 16 KB
6 KB 81ms
16ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 27760
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5728
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 09:04:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "36d96c2d19cb35a6"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 09:04:27 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F05E 92 KB
28 KB 74ms
8ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1612
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28328
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 16:20:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f4788313c10056ed"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 16:20:15 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F05E 3 KB
1 KB 73ms
8ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 27761
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 1414
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 09:04:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ea7b1c90fec06498"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 09:04:26 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F05E 46 KB
15 KB 71ms
6ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 27760
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14863
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 09:04:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "db7c050f8b3f760d"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 09:04:27 GMT

GET
DATA 200
OK truncated
/ Frame F05E 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 70696f64d4166c01fc48556c521fe0048af71777b530f7be0f9734f27e0f3545

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ 20 KB
7 KB 32ms
5ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 7201
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 7178
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:47:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9d3d923337ef7e9b"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:47:06 GMT

GET
H2 200 1952355851393472830
tpc.googlesyndication.com/simgad/ Frame F05E 35 KB
35 KB 15ms
14ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1952355851393472830?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm4QYe19OznhSDmRJnqr-r_lLPgdw

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5995963373c55d31dadf9b25910e0f88b7b9f11d2e1ac2032a3c5391a5c500f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 27 Feb 2020 09:12:16 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 2446491
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 35853
x-xss-protection: 0
expires: Fri, 26 Feb 2021 09:12:16 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F05E 2 KB
3 KB 10ms
9ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 61999
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 26 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F05E 295 B
401 B 11ms
10ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 68027
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 26 Mar 2020 21:53:20 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F05E 0
0 32ms
31ms Image
text/html 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CkjAzi9x8Xv-7DZmtgAfe3KaYDvKsyq1cke6miuUJwI23ARABIMyRriJguwagAfiDkP4DyAEC4AIAqAMByAMIqgSxAk_QsEPVmGfhlQw8OcOaqwpVGYQ5bfVrouJIe2LTH96N_xw7J3ilO8u2b9METtTbjvrUVreV77kawC-XcFvmjikU9iU4X3ZQDiPQDhbPfRi-ReGvByGLVQy22VViCaOfkdfzReh7UrAt_oWAOBSAX0WWWGLnbrFmODExEuQCSPy6NBJN4BtPmsH5_eToaKR_2vj9p1hB4bJ464JUfDZT8ETTjiomurWa1Dd_MFgiAurzIlWHzelFhyaKwWxCcmZPUatAHokm9sedwyH4E94wLxUK0iklgT1UA5UNPJgN3i9cnL8BiXQ-n4TWvhma4PRTN6Kyictt5N3iWodsZIYnIqOJeCZx-utdzVIdBKr4cRFYBaHY5MI4ZS870Iz5-oylujaEAcmUb2Toecg2CruqeeAswATi94vpnwLgBAGSBQQIBBgBkgUECAUYBKAGAoAH8PvvAagHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEJLNDNIICQiA4YAQEAEYHYAKA8gLAdgTAg&sigh=S-mMJajkJGQ&tpd=AGWhJmuR0QFEB6kNQpUqhqUe-9lz34fuTETHmYUAKnAN5fYGWg
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s14-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame BFB3 0
0 58ms
27ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv87cMab-EauRfA2AILNV-VJsgUe6MsTqTAM-ohAzRYQdDOwVSzGxZhOeIEbVvJvM2dTk1orRYoOig5Xy70bC85xUGNxNr_xTeUY20iMm7nvOi1jNYzjQE0lHwwIz67qbpgE7TrpAmx_WnxjDaoUa5jzVM0BaXiVbm2NZybgc2ulRYHOT4soYDvrxtwonJOwvo6UlPeYJb9omd1ClVHcz_BbX4qnmQdtZvWsGbhGXLQVvBiOOwL5F3o8bgz_jPMAw0XEmLOwJ-d&sai=AMfl-YRTIJhYs3Y6JWPT5CyX_1VJ0_u1F_FMv0CkchSj9BOGOxaIHWed-uk8IRDnjW9iycWMfvd5R1i9AHKRIQGUz94aEF8ykb7cI6660BVn&sig=Cg0ArKJSzL-OzJfXLuw_EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame BFB3 74 KB
28 KB 32ms
12ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame BFB3 314 KB
105 KB 26ms
6ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 44AF 0
0 38ms
10ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJiH-CgECIUVpVfFkrlhykMZys14BldciXeJe1GiN4zBPEgAjsyMOaxIs8vagOQEvT2HNtYFwUTbvef_3vu5bObNrSbstjNJ7BTANJVDSpWZbRP_b3iFj8JjK1Zc2uUAET3OxMC7IWpcB1SmVk19m2InZ6alF8ugQq1qmLqqXuZP8SCxyH3cpj75CGi7QnW6M-0yT84_nTj22nGcuPpZlvI2JWl9GHJv3qtYBBbBZ9UMEpjSD3OJ-z9dgXW690NKC1TnjlrjuS&sai=AMfl-YRgty2sYIscwRvwJ7x6r6suuhLXhiRdHAfV19YQShtxkOaJb-AudyJAFf0yk2mhvIQDL4DAHhBFBNs7y7M2pVglKkk2gVnXDrKK20ai&sig=Cg0ArKJSzH9PU8IV_VqbEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 44AF 74 KB
28 KB 31ms
16ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 44AF 314 KB
105 KB 35ms
15ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame CB54 0
0 51ms
16ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOn0zRhK9IxvrrPz7jXwXQogztM2KrEWc_yO12GGnO1EZrrUiPOqXhilCoPQrjcY6kHnp_v5ug9pXssnRHeL6_uKjMsLXXyTwot8vhJdI3JkTBcCNps5ebpB33sxbEMPIE9DkGSqIIVln3Eaf-QayiGXcz9BOA79GmE5dmijKJkIsx2NS9TDfy9fU9d3TYAMxFrS6S7FOkdrNGJB7CfDoQ1WLOOkQHF-ESSv-UMFZyXX4qhga5w89Ysj88cENI0JnCv9yfl8Dg&sai=AMfl-YQ54C2TUkV7T9NW8CiG7xvcFODUlDhXFI5dY855OB962NvyO4nhjLtcAEHsIXK-e1N2AMFYuNrNbFu0FQJ6yV0XB7m4aDGMKR7ZsbuF&sig=Cg0ArKJSzA3kh-iMwbcKEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK adKit.min.js Show response
rev.cbsi.com/common/js/ Frame CB54 6 KB
2 KB 1093ms
8ms Script
application/x-javascript 104.108.48.175
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?1752528482
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.48.175 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-48-175.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 16:47:08 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 May 2019 18:29:20 GMT
Server: AkamaiNetStorage
ETag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame CB54 74 KB
28 KB 31ms
5ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame CB54 314 KB
105 KB 36ms
10ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 40C6 0
0 50ms
23ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssKeovFyWILhVZiClcbHB3Cden9sO8yCvk28h6z53dB9SdMXepNsjnPHUDbWeQxJtg8AHTNaIZyC_BXKXzQirBzSYWtC8lTxjOPpmLMdroq8sDMVDH48dZWp0dADkQea_CA2VjDDCGLxUAXvaYu_zKDM32mf2oNPnika25iTX8zdZHxCw7bAiHIFC7xqRpgPR6CVuXJtNZiLDyaMs5DrVehXfn3SEi8mSvINRzGDGhE8B3J3L0cziYwmDu8pOKmHgyf5yzoj3Mt&sai=AMfl-YRg262lbvx9wOacRNrnk9jQEIj6nMx9NM1ldR8vveVpW_QGVTL8ZiJABi9QX6DZLxgQk_cYCYo4McSXzoCMBrFlH-MJlXC6YYMHle9U&sig=Cg0ArKJSzEB_RVx_cLblEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 40C6 74 KB
28 KB 28ms
11ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 40C6 314 KB
105 KB 20ms
9ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame ABA8 0
0 28ms
28ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNyaZqEXLIwwzvYucjyF2XPq9oXVqc5je3mAblzsJZTLYvuxT-w-cAc_fMicA_c6iGu7d1fc-3KzP4cGG2_AcO_vsAQGupG7-5Qpx37fmc8ACHDO6T7J2fInW3bK_ug4p-fqIEKgoqopzNoxiRn94N1srkhDoR172UKRZbiChBgsdPTzu-BQc---J6Tye9c5xOVEvsyGZUBnTz5Yorv1egJupMORFSv5jcW809M9PyI2X1zskwIH30roeHYgUiwnQ64HbOpOM0&sai=AMfl-YTspdDHDiGHoUQqCGYc4fli_ercpWfLgSNETfpX6yAWOsX8z7kryxt5AWWlEhcDDWmiXp6ABgo8aUT_b_t_2b-G9NbFBMySloZAZe3j&sig=Cg0ArKJSzOIbRTWWiiXOEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame ABA8 74 KB
28 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame ABA8 314 KB
105 KB 21ms
20ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:07 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53640
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame FF08 0
0 39ms
30ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvY2wyfq8DeYgmA-nwtCvZbL4eHxzk9BYVOV92hqV4Q8Fxr8NAaRn5SY_ZFEPvZLJAeIspOlxZbn0mGNEchBdXm3D2wsAYrUmEtuf4ZDvkM3TKORqVQtWt-NVK6sgi0u-jttmkho_ehAyVMeFHKztZV2tSzOVA8gc50Y_gJngy8E6w5AIhxls2cGV3YezKshmxqgAUi1pEhkU6A1XFbdKpBTGtCDhjd9fRV_ipeCyunl1sdzG8--6Q53xqhOfWn2oLCKTOcvqFc&sai=AMfl-YTL2s55Rp4tgjjTrIVz5b_PL8LmEDWEzQFuXfxJZVMoQ--WHnxYUnwAxJHwShfFmmTEcnLqcknVp5ZujnotnCrq_hyp7rVbUuFY6PUi&sig=Cg0ArKJSzK_ekEaI4g0wEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF08 74 KB
28 KB 23ms
16ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame FF08 314 KB
105 KB 31ms
24ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53639
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame BA6C 0
0 35ms
29ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu_bXpK-1QBXcxMfjBFNY_4W9vNOl0ta_1cJm1yP2SxTopRk2W9Btfu-JhjR10Q5KYqr0okOX839P-rsWpaRbKmnjVf4IYR6sUHJKysIkFTJtBxTRljPUpwf4V827VveP62yFH2MAP0BufoH03xVTfkFw-UX518WGdquIOHpazN1Zr9CgEsoZhtYMycrfS136jImMwwgPXYFZUztdVdqjfMESLgK-a7JFacBafFo7rsZlqgxaVSLm_zx4iVUy4hEsWHQX2DBpi1&sai=AMfl-YSOuydYqGs0-ql3dgvZtblzkwQmDj3HnLcQn9EFJgLv63rCO5wEzyfEKo5G8ZWQbQ14X4ZYH4egGZmRmpJ5UqG5TCIIQFk6V__q9JNL&sig=Cg0ArKJSzFBjSkWwAi9nEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame BA6C 74 KB
28 KB 28ms
21ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:08 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame BA6C 314 KB
105 KB 32ms
26ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53639
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 n.js Show response
geo.moatads.com/ 111 B
285 B 358ms
38ms Script
text/html 63.35.59.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=18&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585241228241&de=455054940917&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=2&cb=0&ym=0&cu=1585241228241&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=7a61fa7a-4ecb-4aee-af48-67012916ed59&zMoatSN=c&zMoatCURL=zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A464%3A464%3A0%3A437&iq=na&tt=na&tu=&tp=&fs=178191&na=191941581&cs=0&callback=DOMlessLLDcallback_89616932
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.35.59.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-35-59-66.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 2fe57900b9e85fed1f030f1708fe32a0b13d84850fb3b9398fc4174e146d4d08

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
server: TornadoServer/4.5.3
etag: "79a822f209409fc93f8cff5b188d00821eb4f527"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 111

GET
H2 200 n.js Show response
geo.moatads.com/ 113 B
288 B 354ms
37ms Script
text/html 63.35.59.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=18&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585241228241&de=455054940917&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=3&cb=0&ym=0&cu=1585241228241&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=7a61fa7a-4ecb-4aee-af48-67012916ed59&zMoatSN=c&zMoatCURL=zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A464%3A464%3A0%3A437&iq=na&tt=na&tu=&tp=&fs=178191&na=1501049298&cs=0&callback=MoatDataJsonpRequest_89616932
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.35.59.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-35-59-66.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 0e75b9fd0d9762b4a07eeebda8fcb58a10638984e133c876bd56facd18dea6fe

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:08 GMT
server: TornadoServer/4.5.3
etag: "b18f5a9d8b69883050524851fd3852765bbe18cd"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 113

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame ED7E 52 KB
20 KB 9ms
7ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame BFB3 52 KB
20 KB 10ms
10ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 44AF 52 KB
20 KB 7ms
6ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame ABA8 52 KB
20 KB 7ms
6ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame BA6C 52 KB
20 KB 10ms
10ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame FF08 52 KB
20 KB 8ms
7ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame F05E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

42ms
40ms

Image
text/html

2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Thu, 26 Mar 2020 16:47:09 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 40C6 52 KB
20 KB 9ms
6ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2283
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 1952355851393472830
tpc.googlesyndication.com/simgad/ Frame F05E 35 KB
35 KB 10ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1952355851393472830?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm4QYe19OznhSDmRJnqr-r_lLPgdw

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5995963373c55d31dadf9b25910e0f88b7b9f11d2e1ac2032a3c5391a5c500f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 27 Feb 2020 09:12:16 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 2446493
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 35853
x-xss-protection: 0
expires: Fri, 26 Feb 2021 09:12:16 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F05E 2 KB
3 KB 10ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 62001
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 26 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F05E 295 B
360 B 8ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 68029
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 26 Mar 2020 21:53:20 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
337 B 39ms
15ms XHR
text/plain 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=365082&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183728-122510094381206.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:09 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame CB54 44 KB
15 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1752528482

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fd89c4e7593e7e15a1ecdf7141192ba9751023d1fbfa77ba998df510306b4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "467 / 400 of 1000 / last-modified: 1585081375"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14788
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ED7E 0
316 B 474ms
159ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4q4&chm=1&ctx=2&qqid=CNqm5-HLuOgCFZkW4AodXq4J4w&met.4=fb.4~lb.au~ol.g8~idt.22d~dt.-u0&met.3=197.am~123.aj_5~117.g2~118.ow_1~197.ox~118.p9~118.tk~143.tr_1~118.tt~118.ue~118.ug~118.uj~118.uk~118.uv~118.uz~118.wf~118.wx~118.xk~118.xl~143.yy_1~113.zk_3~112.zj_5~118.11j&met.1=1.k88zp3ql~14.0~15.0~16.0~17.0~18.0~19.0~20.g2~21.g8&met.7=CCoQChgBIAYoBjBOOEg~CBsQCiAGOF8~CCgQChgBIIIHKIIHMIwHOAtohAdwiwd4xKABgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BFB3 0
47 B 479ms
166ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4qa&chm=1&ctx=2&qqid=CNym5-HLuOgCFZkW4AodXq4J4w&met.4=fb.5~lb.fa~ol.gd~idt.215~dt.-v8&met.3=197.f9~123.f8_1~117.gb~118.nk_1~118.o2~118.sc~197.sk~118.sl~143.sn_1~118.t4_1~118.t6~118.t6~118.t9~118.tn~118.tr~118.v7~118.vv~118.wd~143.xr_1~118.xy~113.yh_1~112.yg_1~118.10b&met.1=1.k88zp3rt~14.1~15.1~16.1~17.1~18.1~19.1~20.gb~21.ge&met.7=CCoQChgBIAcoBzA8ODY~CBsQCiAHODo~CCgQChgBIOMGKOMGMPIGOA9o5AZw7QZ42J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 44AF 0
47 B 437ms
176ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4sd&chm=1&ctx=2&qqid=CN2m5-HLuOgCFZkW4AodXq4J4w&met.4=fb.6~lb.ev~ol.i6~idt.20v~dt.-vi&met.3=197.eu~123.et_1~117.hs~118.nc~118.nr~118.s8~197.sa~118.sb~118.sx~118.sy~118.sz~143.t4_1~118.te~118.ti~118.ux~118.vw~118.w4~118.xj~143.xt_1~113.10a_1~112.10a_1~118.10f~118.124~118.129&met.1=1.k88zp3s3~14.0~15.0~16.0~17.0~18.0~19.0~20.hs~21.i6&met.7=CCoQChgBIAgoCDAzOCs~CBsQCiAIODA~CCgQChgBIPwHKPwHMIYIOApo_gdwhAh42J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABA8 0
47 B 434ms
175ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4sh&chm=1&ctx=2&qqid=COCm5-HLuOgCFZkW4AodXq4J4w&met.4=fb.4~lb.eq~ol.gq~idt.1yg~dt.-xx&met.3=197.ep~123.eo_1~117.go~118.ky~118.ld~118.po~118.px~118.qj~118.qj~118.ql~118.qz~118.r3~143.r9_1~118.sj~118.tk~118.tq~118.vd~143.wd_1~113.xz_1~112.xz_1~118.zn_1~118.zq~118.zu&met.1=1.k88zp3ui~14.0~15.0~16.0~17.0~18.0~19.0~20.go~21.gq&met.7=CCoQChgBIAUoBTAmOCE~CBsQCiAFOCc~CCgQChgBIKkHKKkHMLEHOAloqQdwsAd42J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BA6C 0
47 B 427ms
174ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4sl&chm=1&ctx=2&qqid=COKm5-HLuOgCFZkW4AodXq4J4w&met.4=fb.4~lb.hr~ol.io~idt.1xo~dt.-yp&met.3=197.hq~123.hp_2~117.ik~118.k6~118.kl~118.ow~118.p4~118.pu~118.q8~118.q8~118.q9~118.qb~143.r9_1~118.rr~118.sp~118.sy~118.t6~143.wt_1~113.xb_1~112.xb_2~118.z0~118.z2~118.z5&met.1=1.k88zp3va~14.0~15.0~16.0~17.0~18.0~19.0~20.ik~21.io&met.7=CCoQChgBIAYoBjAqOCM~CBsQCiAHODQ~CCgQChgBILEHKLEHML4HOA1osgdwvAd42J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame FF08 0
47 B 424ms
173ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4sn&chm=1&ctx=2&qqid=COGm5-HLuOgCFZkW4AodXq4J4w&met.4=fb.4~lb.i3~ol.k0~idt.1y4~dt.-y9&met.3=197.i2~123.i0_2~117.jw~118.km~118.l1~118.pc~118.pk~118.qa~118.qn~118.qw~118.qw_1~118.qx~118.s7~143.si_1~118.t4~118.te~118.us~113.xw_1~112.xt_3~143.y6_2~118.zg~118.zi&met.1=1.k88zp3uu~14.0~15.0~16.0~17.0~18.0~19.0~20.jw~21.jz&met.7=CCoQChgBIAYoBjA2ODE~CBsQCiAGOEA~CCgQChgBIMsHKMsHMNgHOA1ozwdw1gd42J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame F05E 0
56 B 166ms
160ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1585241229243&qqid=CL-t7eHLuOgCFZkW4AodXq4J4w&rt=a4a.link.3.2l.m.c.1b.2.17u2.172b~a4a.script.4.2n.c.r.1b.2.1765.172b~cdn.script.4.2a.1.q.0.0.4hf.4f4~aa.script.4.2f.d.g.0.0.ly8.luw~cdn.script.4.21.1.f.0.0.16d.13a~cdn.script.4.20.1.d.0.0.c7w.bgv~simg.img.e.h.1.e.0.0.rs9.rnx~any.img.e.b.1.9.0.0.23u.1xi~any.img.e.f.4.a.0.0.b5.87~any.img.f.x.1c.0.0.0.0.0~simg.img.xm.c.2.6.0.0.rqa.rnx~any.img.xp.a.1.8.0.0.1zb.1xi~any.img.xt.9.1.6.0.0.a0.87&met.a4a=dcl.1~ol.1140~nvs.1585241227831~ini.1585241229244
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 40C6 0
56 B 167ms
161ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4uh&chm=1&ctx=2&qqid=CN-m5-HLuOgCFZkW4AodXq4J4w&met.4=fb.5~lb.g9~ol.ps~idt.20a~dt.-w3&met.3=197.g8~123.g8_1~118.mr~118.n6~117.pq~118.rh~118.rq~118.sf~197.sh~118.st~118.sw~118.ul~118.um~118.um~143.vb_1~118.vj~118.x7~118.x8~143.112_1~118.11k~118.11o~113.11t_1~112.11s_1~118.12a&met.1=1.k88zp3so~14.0~15.0~16.0~17.0~18.0~19.1~20.pq~21.ps&met.7=CCoQChgBIA0oDTAtOCA~CBsQCiAVOBg~CCgQChgBIM8IKM8IMNkIOApo0Qhw2Ah43J8BgAGRnwGIAZmfA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame CB54 109 B
839 B 32ms
18ms Script
application/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame CB54 109 B
839 B 30ms
15ms Script
application/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020032401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame CB54 168 KB
62 KB 14ms
14ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

123d4b411f97e36f72e2f44be0b18944489e908ff159f59ab8aba984c69517fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 13:43:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62966
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame CB54 31 KB
7 KB 81ms
81ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3215668957805828&correlator=159190848192292&output=ldjh&impl=fifs&eid=21065778%2C21062888%2C21065202%2C21065391&vrg=2020032401&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dc%26subses%3D3%26ptype%3Darticle%26vguid%3D7a61fa7a-4ecb-4aee-af48-67012916ed59%7Cenv%3Dprod%26session%3Dc%26subses%3D3%26ptype%3Darticle%26vguid%3D7a61fa7a-4ecb-4aee-af48-67012916ed59&cookie=ID%3D50764157a2a77d29%3AT%3D1585241227%3AS%3DALNI_MZBmbbsQtVANxLR3qtY28GEzBYNig&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1585241229&dt=1585241229387&dlt=1585241227886&idt=1485&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=x0yqu2oxzu1j%7Cn4qsb8yttq5e&ifi=1&ifk=1272445485&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&dssz=19&icsg=10888&std=0&rumc=3215668957805828&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1119865795.1585241229&ga_sid=1585241229&ga_hid=1585048066&fws=256%2C256&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

c56d96daf11894dd062360bacacb0b9107b15cca513e885a197ee02968f42747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 7532
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239468731,138239479696
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020032401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame CB54 66 KB
24 KB 16ms
16ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

0290a012deb1b25451f5211d8cb8b40d8fa6f3942d23ecc12d96670e4c0ed7a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 13:43:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 24573
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame CB54 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame CB54 52 KB
20 KB 7ms
7ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2283
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame CB54 52 KB
20 KB 7ms
7ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2283
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
server: cafe
etag: 6427117084993990873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Mar 2020 17:09:06 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CB54 0
214 B 16ms
13ms Image
image/gif 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=www.zdnet.com&doc=complete&pg_h=0&pg_w=371&pg_hs=771&c=0&aa_c=0&dt=d

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame CB54 0
56 B 167ms
161ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4zw&c=3215668957805828&e=21065778%2C21062888%2C21065202%2C21065391&ctx=1&met.1=1.k88zp3sd~14.1~15.1~16.1~17.1~18.1~19.1~20.174~21.176&met.3=113.17i_1~112.17i_1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2007 0
0 22ms
21ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuhHPQ_vzcR5cgsSQf4n4u28FST-of84DeuZdYIbaTtFRADGv_2n7B-rrI5xbbXyOmfZSdlNNcfMIxOiWLAq5fXjYbud-zJeGe_a7NUzXuDVHOdXj8Lo7jft0gFMi77Rvn6umUD63LoAesQlZNO45lYSRXKb-tFkC0AFjDIUmlXJqcSFJtozvnw3nfefaoOpmo3bcu3qeyQ3YwcRtDwlYgrUsE3Szs8vOlyThYBteotNMKC0RhDkkPFuOGZMn-b13CsG_hCgnCV&sig=Cg0ArKJSzM_zW7D5DonWEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:09 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2007 74 KB
28 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 2007 314 KB
105 KB 15ms
14ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53638
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame CB54 74 KB
27 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28015
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 07DC 0
0 22ms
19ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu05kGg8igtp66prnExUqpSFH-TCor493HSjKZt17Ombjlu4K0Bypdx8imVVyRT_BWfSo7zzk2QaCYuDUGlF7mOfS0wCmzqV8dzn7qfohCzP3WfehTVpU0hdRHAQB3nYk0OSy4Tp9a8pHbf5CimgP5IlgcdwKo5k3bJGniQ-ECwkCeNdAiSlAxT_mgl9xFGsSZNizb2rB1aT4pDzWuNXS_izfNpLG0jgycR6N3CkyiU0zupG5gB7tU59pdL52FoaisCqfnHrDDm&sig=Cg0ArKJSzMfAj59ZN77sEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:09 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 07DC 74 KB
28 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 07DC 314 KB
105 KB 15ms
15ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 16:53:28 GMT
server: AmazonS3
x-amz-request-id: 08ECB22213F3292C
etag: "2615d14012bc2e6c09dcdff2dd6bcd8e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53638
accept-ranges: bytes
content-length: 107119
x-amz-id-2: Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame CB54 7 KB
6 KB 49ms
20ms XHR
application/json 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1db58066d3bbb23a4a0b244a9778ab6bb2ac1e2d2a42eab6861c6a51dfc919c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5188
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame CB54 14 KB
5 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:09 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 4AE1 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 26 Mar 2020 16:06:22 GMT
expires: Fri, 26 Mar 2021 16:06:22 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2447
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CB54 0
58 B 15ms
15ms Image
image/gif 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032401&jk=3215668957805828&bg=!ZWalZn5YbYknvRLYxBoCAAAAT1IAAAANmQFf-efb1tHwBwRSMm4E4p_Pp7wq-QNcMt7Xxh0zOFUDxn6iJLYANLCZWb4NrkbiPnlE64FUnKrhW6AzFuCHyOqfR5E1Gy2rKXKSadNlJS4Df1LXrWEJH4di7SZu7ysQyokwK5Ga2XA3EiMNW_Y3Ej30uUVAXWf4iHURlDa0f7X1Y0lfSY_HhFyXjRv_hJwKxXpoh9AfInq9RmBEMne8OtQn5aJV2kqtpghQz_FsNKYNKmgQzf8U8rNjH5MvG1PJBtUL-CG1fAF_MMvvlHSHNiDGCNE56lji_h7Eoh1IKtN4uk0mUj4tpLh4y2UEuqBqtMqre3UdaaD4lynku-cZIoMjHlC7oO8_cRPvUO8iJzmzV3_M80fq5Yi6bFKohM_uR0C7n4pxondEvHdvTmce1wXMDGdoit2LuSsZfZmoNb7LeE53VPp9prUKPZIhfx2igKFxuzzrMy_CSYyXtYNlszBm

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F05E 42 B
115 B 16ms
16ms Image
image/gif 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsujDvkYJ90r9MNOXmelBeA6SU_RcM8ZvaX3OvrR6HfUDWw_c0W0k8_U-qr1AE3ebTrTX-jEN9cj9qtE04-dExY2M-JKLU7iIdA75A3_t4qUuZetNg_-EjEGYyNRng&sai=AMfl-YQuH-MIT01a62M8kIhM4I6cQZe7YDi2MVYihPy4TCcx7NxCxZan7SXg-hV1sBxMGFPcqJvU-xSVq80VfYO-PSSTj14XkSeVoY22WjBg&sig=Cg0ArKJSzLnYrGGqI9VpEAE&id=ampim&o=429,307&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=492&tls=1493&g=100&h=100&tt=1493&r=v&adk=3581870410&avms=ampa

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame CB54 0
47 B 157ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k88zp4zg&c=3215668957805828&e=21065778%2C21062888%2C21065202%2C21065391&ctx=1&met.4=fb.5~lb.yz~ol.175~idt.20l~dt.-vs&met.3=197.yy~123.yx_2~118.11u~197.13q~118.13q~118.13q~118.13z~118.14h~118.16a~112.173~117.174~118.176~118.176~118.177~113.177_1&met.9=1.14a~2.15a~3_1.15z~7_1.0~7_2.0&met.1=1.k88zp3sd~14.1~15.1~16.1~17.1~18.1~19.1~20.174~21.176&qqid.1=CNuj8-LLuOgCFR3juwgdRRQJAA&qqid.2=CN2j8-LLuOgCFR3juwgdRRQJAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 115 B
457 B 49ms
34ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 57a25a2a4b02c28b-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/ 94 KB
14 KB 16ms
13ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/en.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE1) /
Resource Hash: d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
content-md5: naVpQbWe8gSjPtoc7a+kTw==
age: 6941
x-cache: HIT
status: 200
content-length: 14612
x-ms-lease-status: unlocked
last-modified: Sat, 22 Feb 2020 00:50:01 GMT
server: ECAcc (frc/8FE1)
etag: 0x8D7B731263A88EC
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 13ea7552-e01e-00f6-0b7e-03fff0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:13 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c44558c7e5c9da9acc834af8d934663e2db4b08a0b16809014a5ffc22197373

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5146
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 26 Mar 2020 16:47:13 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame FF08 0
56 B 156ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4uu&chm=1&ctx=2&qqid=COGm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgsYyycgZyoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABA8 0
56 B 156ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4ul&chm=1&ctx=2&qqid=COCm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgsY1ycgZyoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
1 KB 188ms
168ms XHR
application/json 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a08c0a09a279b490a7df8c65edcf19348652f372d72d1fb39e078dfd340284a3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 513
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 26 Mar 2020 16:47:04 GMT
x-frame-options: SAMEORIGIN
date: Thu, 26 Mar 2020 16:47:13 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: aad030d6-7793-4817-949c-3d44c197f412
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 26 Mar 2020 18:17:04 GMT

GET
H2 200 image-gallery-modal-426b98fe1d-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 21ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596931
status: 200
strict-transport-security: max-age=31536000
content-length: 1866
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-1328"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:21 GMT

GET
H2 200 09-rsync.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/ 26 KB
26 KB 23ms
17ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/09-rsync.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1574661
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 26578
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"389c96d539ed67bd670f0a32d9765469"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 10-couchdb.png
zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/ 26 KB
26 KB 52ms
31ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/10-couchdb.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152911
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 26710
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"3af65294001defdf7d60d4b9e3151fff"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 12-etcd.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/ 30 KB
30 KB 12ms
7ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/12-etcd.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152911
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 30537
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"c754f5d09de891bf9429e3a39af69ab6"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 13-firebase.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/ 25 KB
25 KB 21ms
18ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/13-firebase.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2541487
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 25563
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"4490759a6b69ecb7c170d8e1476be569"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 14-jira.png
zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/ 28 KB
29 KB 28ms
9ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/14-jira.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 720937
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 29043
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"24f1f625bd45de40d754ee728086e4dc"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 15 KB
3 KB 10ms
8ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otFlat.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FF1) /
Resource Hash: 7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
content-md5: 4X6tFR1iNZJA0ugA60GXmg==
age: 7506
x-cache: HIT
status: 200
content-length: 2748
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:29 GMT
server: ECAcc (frc/8FF1)
etag: 0x8D7B70A60DF65FE
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9fd05985-601e-0160-427c-03db91000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:13 GMT

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 72 KB
13 KB 11ms
9ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otPcPanel.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E97) /
Resource Hash: 59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
content-md5: CHY1OTgtshtK4vchnpokaA==
age: 7499
x-cache: HIT
status: 200
content-length: 12882
x-ms-lease-status: unlocked
last-modified: Fri, 21 Feb 2020 20:12:30 GMT
server: ECAcc (frc/8E97)
etag: 0x8D7B70A613D4F2A
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9c9913ac-f01e-006a-617c-03844d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Thu, 26 Mar 2020 20:47:13 GMT

GET
H2 200 disqus-loader-ba8cc73646-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
727 B 8ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-ba8cc73646-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596934
status: 200
strict-transport-security: max-age=31536000
content-length: 640
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-57e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:18 GMT

GET
H2 200 google-releases-chrome-extension-to-chec-5c5d72e060b2f4baaf802e17-1-feb-12-2019-11-03-41-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/02/12/8f3efd6f-cb30-4ac3-8e1c-24bc1389d4a7/thumbnail/170x128/b182fb4a8067b670ead68d38bc333262/ 3 KB
3 KB 14ms
7ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/02/12/8f3efd6f-cb30-4ac3-8e1c-24bc1389d4a7/thumbnail/170x128/b182fb4a8067b670ead68d38bc333262/google-releases-chrome-extension-to-chec-5c5d72e060b2f4baaf802e17-1-feb-12-2019-11-03-41-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

03bcc1f2b1cd14113d9289d50792bce03d9acf51e3d9dfbe4e7f3ff9ae460cc8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 634
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 3497
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"a9de093d0622ed782d267fa3f1953228"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 badusb-letter.jpg
zdnet2.cbsistatic.com/hub/i/r/2020/03/26/2681319f-e405-407a-a460-80920c55fe36/thumbnail/170x128/d96f58e91223c6e97765964ea2567dfe/ 6 KB
6 KB 24ms
18ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2020/03/26/2681319f-e405-407a-a460-80920c55fe36/thumbnail/170x128/d96f58e91223c6e97765964ea2567dfe/badusb-letter.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

837593028a367c7230b6031ca957137803fc1538687f56046c4b398b17dbd1cc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13398
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 6018
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"9ac1382fd8fc4b631594aa135d16ad75"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/ 3 KB
3 KB 14ms
8ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43194
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 3030
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"a2186aa7c086b46ad4e8bf81e2a3a19b"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 darkwebistock-935673948wildpixel1.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/ 6 KB
6 KB 15ms
8ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/darkwebistock-935673948wildpixel1.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
x-content-type-options: nosniff
age: 67210
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 5669
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8a7129b8f3edd95b7d969dfc2c8e9d9d"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
919 B 869ms
866ms XHR
application/json 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c93da10a0b37f717f799eb43bbed14f84d8cc6aeafcdbf27ca26621da0effae3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 756
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
date: Thu, 26 Mar 2020 16:47:14 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: e018fc13-8eae-43ec-8ebd-10a6e82a5b1b
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 front-door-carousel-d989216481-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596934
status: 200
strict-transport-security: max-age=31536000
content-length: 1552
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-1251"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:19 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

03bcc1f2b1cd14113d9289d50792bce03d9acf51e3d9dfbe4e7f3ff9ae460cc8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 634
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 3497
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"a9de093d0622ed782d267fa3f1953228"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43194
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 3030
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"a2186aa7c086b46ad4e8bf81e2a3a19b"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/darkwebistock-935673948wildpixel1.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
x-content-type-options: nosniff
age: 67210
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 5669
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8a7129b8f3edd95b7d969dfc2c8e9d9d"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2020/03/26/2681319f-e405-407a-a460-80920c55fe36/thumbnail/170x128/d96f58e91223c6e97765964ea2567dfe/badusb-letter.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

837593028a367c7230b6031ca957137803fc1538687f56046c4b398b17dbd1cc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13398
status: 200
content-transfer-encoding: binary
x-image-exists: 1
strict-transport-security: max-age=31536000
content-length: 6018
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"9ac1382fd8fc4b631594aa135d16ad75"
vary: Accept-Image-Webp,Accept-Image-Webv
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 3E8C 0
0 30ms
24ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 26 Mar 2020 16:06:22 GMT
expires: Fri, 26 Mar 2021 16:06:22 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2451
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

POST
H2 204 csi
csi.gstatic.com/ Frame FF08 0
56 B 156ms
155ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~k88zp7uo&chm=1&ctx=2&qqid=COGm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgwYiioghAEqBAgIEgA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABA8 0
47 B 158ms
158ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~k88zp7uo&chm=1&ctx=2&qqid=COCm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgwYlioghAEqBAgIEgA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show-hide-1.0-7bf562809f-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
731 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596934
status: 200
strict-transport-security: max-age=31536000
content-length: 673
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-71c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:19 GMT

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 42 B
721 B 35ms
34ms XHR
text/javascript 34.250.145.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.145.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-145-255.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 015e3eec7e95e21495ba3d0143d078f76e76f79d2d81f9e5d036e357459153e4

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:13 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 204
No Content /
364bf6cc.akstat.io/ 0
354 B 386ms
370ms Other
image/gif 2a02:26f0:6c00:181::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://364bf6cc.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 16:47:13 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 26 Mar 2020 16:47:13 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 15ms
14ms Image
image/gif 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032301&jk=2943858184341641&bg=!1Nel189YrjW2x540tQ8CAAAAVFIAAAALmQFZXVLEAE8UMPdJVRfW8L8AHuZ0cbpP-GanYaNb-McClOqxFdU7_gul-TIjoFAVxeG2flJn9QM1mKrKGAab85D1navyiITXPusJj9qQ4VPlzF4VPdrvql7nnfiDny-f2Lru_0xcG5-S2P-JSD6v9Lo0eBr0N6x1-jpk1eQQCxrCQBxpYjbQjspv_0e2PB5CTwzraZxfaLDe4Mp2oQsXfST90uvEkNJ1kbHz2OvkosvYpwy7ahHs4QdVi0CU4fy9wenvn8UfRMm1kwizpxLaQShNEOXXs3SLPCQykn9NEcIXAC-lPaIRji9j0H74P9cwT8Gk_oq-pVneHFJMp01uz73f2Lo8TVIjdBn9hsQlAhuerh244t3CmJcG0yUok_Ip0jRe2P9N7KjXeijtIN-HEFB7UgplQcMtYjhCEurUtvUGUdufhjL3ux9ycxoqri9EN66F_hw2sMnt9GMp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:13 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 320ms
108ms Image
image/gif 18.209.91.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&u=DzAnuSprXi_eX7Ex&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.25&x=0&m=0&y=5149&o=1585&w=1200&j=30&R=1&W=0&I=0&E=5&e=5&r=&b=2701&t=CkRU2NDPuFs8QJUS7D85g-P2LDG5&V=118&tz=-60&_acct=anon&sn=2&sv=BszTyhC8tOydBRNMXoDjgK3SBkqHfO&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.91.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-91-145.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
pragma: no-cache
date: Thu, 26 Mar 2020 16:47:19 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 43
content-type: image/gif

OPTIONS
H2 200 event Show response
at.cbsi.com/lib/api/v1/ 4 B
355 B 654ms
639ms Fetch
text/html 151.101.65.188
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://at.cbsi.com/lib/api/v1/event

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.188 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend / Express

Resource Hash

9aee6b1bcdf617d8e39bb1f2b624c68ea33deb9d48e0364aeaded836d3d00293

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Access-Control-Request-Method: POST
Origin: https://www.zdnet.com
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: cat,content-type

Response headers

date: Thu, 26 Mar 2020 16:47:21 GMT
via: 1.1 varnish
vary: Accept-Encoding
x-powered-by: Express
x-cache: MISS
status: 200
otest: at.cbsi.com
content-length: 4
x-served-by: cache-hhn4058-HHN
allow: POST
server: Google Frontend
x-timer: S1585241241.691259,VS0,VE633
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
strict-transport-security: max-age=300
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
x-cloud-trace-context: cf6c9005efca8ecee0a5c7f1aac25dfc
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 0

POST
H2 204 csi
csi.gstatic.com/ Frame CB54 0
47 B 158ms
158ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4zx&c=3215668957805828&e=21065778%2C21062888%2C21065202%2C21065391&ctx=1&met.9=4_1.18d~5_1.18i~5_2.18r~6_1.1ax~6_2.1bq&met.3=118.19h~143.1a8_1~298.1b6~298.1b6~155.1az_9~118.1b9~132.1b9~130.1bq~118.1by~132.1by~132.1cb~118.1cl~132.1cl~132.1cl~118.1cw~132.1cw~132.1cx~118.1cx~132.1cx~132.1cx~118.1d4~132.1d4~143.1d6_1~118.1dq~132.1dq~143.1e5_1~118.1fy~132.1fy~143.1g2_1~118.1g3~132.1g3~143.1hd_1~118.1ir~132.1is~143.1iw_1~118.1ix~132.1ix~143.1k7_2~118.1lm~132.1lm~143.1lr_1~118.1ls~132.1ls~143.1n7_1~118.1oh~132.1oi~143.1ol_1~118.1on~132.1on~143.1q0_1~118.1rc~132.1rc~143.1re~118.1rf~132.1rf~143.1st_1~118.1u6~132.1u7~143.1u8~118.1u9~132.1u9~143.1vn_1~118.1x2~132.1x2~143.1x5~118.1x6~132.1x6~143.1yg_1~118.1zw~132.1zw~143.1zy_1~118.200~132.200~143.219_1~118.22t~132.22t~143.22y_1~118.22z~132.22z~143.242_1~118.25n~132.25o~143.25r_1~118.25r~132.25r~143.26v_1~118.28i~132.28i~143.28k~118.28l~132.28l~143.29p_2~118.2bd~132.2bd~143.2bf_1~118.2bi~132.2bi~143.2cs_1~118.2e8~132.2e8~143.2ea~118.2ec~132.2ec~143.2fm_1~118.2h3~132.2h4~143.2h7_1~118.2hd~132.2hd~143.2if_1~118.2k4~132.2k4~143.2k6_1~118.2k8~132.2k8~143.2l8_1~118.2my~132.2my~143.2n0_1~118.2n2~132.2n2~143.2o2_1~118.2pu~132.2pu~143.2pz_1~118.2q2~132.2q2~143.2qy_1~118.2sq~132.2sq~143.2su_1~118.2sw~132.2sx~143.2tr_2~118.2vq~132.2vr~143.2vu_1~118.2vw~132.2vw~143.2wl_2~118.2ym~132.2ym~143.2yq_1~118.2yv~132.2yv~143.2zg_1~118.31f~132.31g~143.31j_1~118.31k~132.31l~143.329_1~118.34b~132.34b~143.34e_1~118.34f~132.34f~143.353_1~118.376~132.376~143.37a_1~118.37d_1~132.37e~143.37y_1~118.3a3~132.3a3~143.3a5_1~118.3a7~132.3a8~143.3as_1~118.3cy~132.3cy~143.3d0~118.3d1~132.3d2~143.3dl_1~118.3ft~132.3ft~143.3fw_1~118.3fz~132.3fz~143.3gf_1~118.3ip~132.3ip~143.3it_1~118.3iw~132.3ix~143.3j9_1~118.3lk~132.3lk~143.3ln_1~118.3lo~132.3lo~143.3m3_1~118.3og~132.3og~143.3oi_1~118.3ol~132.3ol~143.3ow_1~118.3rb~132.3rb~143.3rd_1~118.3rh~132.3rh~143.3rp_1~118.3ue~132.3ue~143.3uf_1~118.3un~132.3un~143.3un_2~118.3x5~132.3x6~143.3x9_1~118.3xa~132.3xa~143.3xz_1~143.42e_1~143.42f_1~118.44g~132.44g~118.45d~132.45e~143.46e_1~143.46f_1~118.476~132.476~118.47z~132.47z~143.4cy_1~143.4cz_1~118.4d6~132.4d6_2~118.4d9~132.4d9~118.4fu~132.4fu~143.4fw_1~143.4fy_1~118.4g2~132.4g2~118.4in~132.4in~143.4it_1~143.4iu_1~118.4iw~132.4iw~118.4lk~132.4lk~143.4lm~118.4lm~132.4lm~143.4ln_1~118.4of~132.4of~143.4oh~143.4oh_1~118.4oi~132.4oi~118.4r9~132.4ra~143.4rc~143.4rd_1~118.4re~132.4re~118.4u5~132.4u5~143.4u8~143.4u8_1~118.4ub~132.4ub~118.4wz~132.4wz~143.4x1_1~143.4x6_1~118.4x9~132.4xa~143.500_1~143.502_1~118.50g~132.50g~118.50n~132.50n~143.52u_1~118.52v~132.52v~143.52v_1~118.53c~132.53c~143.55n_1~118.55o~132.55o~143.55p_1~118.567~132.567~143.58h_1~118.58i~132.58i~143.58i_1~118.591~132.591~143.5bb_1~118.5bb~132.5bc~143.5bc_1~118.5bx~132.5bx~143.5e4_1~118.5e4_4~132.5e9~143.5e9_1~118.5et~132.5et~143.5gw_1~118.5gx~132.5gx~143.5h4_1~118.5ho~132.5hp~143.5jp_1~118.5jq~132.5jq~143.5jy_2~118.5kj~132.5kj~143.5mi_1~118.5mj~132.5mj~143.5ms_1~118.5ne~132.5ne~143.5pg_1~118.5po~132.5po~143.5po_1~118.5q9~132.5qa~143.5s9_1~118.5sa~132.5sa~143.5si_1~118.5t7~132.5t7~143.5v2_1~118.5v3~132.5v3~143.5vb_3~118.5w2~132.5w2~143.5xv_1~118.5xv~132.5xw~143.5y7_1~118.5z5~132.5z6~143.60o_1~118.60p~132.60p~143.610_3~118.622~132.622~143.63h_1~118.63i~132.63i~143.63v_1~118.657~132.657~143.66a_1~118.66b~132.66b~143.66p_1~118.67y~132.67y~143.693_1~118.694~132.694~143.69j_1~118.6at~132.6au~143.6bw_1~118.6bx~132.6bx~143.6cd_2~118.6do~132.6do~143.6ep_1~118.6ep~132.6ep~143.6f6_1~118.6gj~132.6gj~143.6hj_1~118.6hk~132.6hl~143.6hz_1~118.6jd~132.6jd~143.6kc_1~118.6kd~132.6ke~143.6kt_1~118.6m9~132.6m9~143.6n5_1~118.6n6~132.6n7~143.6nn_1~118.6p4~132.6p4~143.6pz_1~118.6pz~132.6q0~143.6qg_1~118.6ry~132.6ry~143.6sr_1~118.6ss~132.6ss~143.6t9_1~118.6us~132.6us~143.6vl_1~118.6vm~132.6vm~143.6w2_1~118.6xm~132.6xm~143.6ye_1~118.6ye~132.6yf~143.6yv_1~118.70g~132.70g~143.716~118.717~132.717~143.71o_1~118.73a~132.73a~143.73z_1~118.740~132.740~143.74h_1~118.765~132.765~143.76s~118.76s~132.76s~143.77a_1~118.78z~132.78z~143.79k~118.79l~132.79l~143.7a2_1~118.7bt~132.7bt~143.7cd_1~118.7cd~132.7ce~143.7cv_1~118.7eo~132.7eo~143.7f5~118.7f6~132.7f6~143.7fo_1~118.7hi~132.7hi~143.7hy_1~118.7hz~132.7hz~143.7ih_1~118.7ke~132.7ke~143.7kz_1~118.7l1~132.7l1~143.7la_1~118.7n9~132.7na~143.7nt_1~118.7nt~132.7nt~143.7o3_2~118.7q5~132.7q5~143.7qn_1~118.7qr~132.7qs~143.7qx_2~118.7t1~132.7t2~143.7u3_1~143.7u4_1~118.7ub~132.7ub~118.7vv~132.7vw~143.7ww_1~118.7wx~132.7wx~143.7wx_1~118.7yt~132.7yt~143.7zp_1~118.7zq~132.7zq~143.7zq_1~118.81n~132.81n~143.82i_1~118.82l~132.82l~143.82l_1~118.84j~132.84j~143.85b_1~118.85c~132.85c~143.85e_1~118.87c~132.87c~143.886~118.888~132.888~143.888_1~118.8a7~132.8a7~143.8az~118.8b0~132.8b0~143.8b2_1~118.8d1~132.8d1~143.8ds~118.8ds~132.8ds~143.8dv_1~118.8fv~132.8fv~143.8gl_1~118.8gl~132.8gm~143.8gn_1~118.8iq~132.8iq~143.8jd~118.8je~132.8je~143.8jh_1~118.8lk~132.8lk~143.8mf_1~143.8mh_1~118.8mi~132.8mi~118.8of~132.8of~143.8ph_2~143.8pj_5~118.8pr~132.8ps~118.8rj~132.8rj~143.8sb_1~118.8se~132.8se~143.8sg_1~118.8ud~132.8ud~143.8v4~118.8v5~132.8v5~143.8va_1~118.8x7~132.8x7~143.8xx~118.8xx~132.8xx~143.8y2_1~118.902~132.902~143.90p_1~118.90q~132.90q~143.90w_1~118.92x~132.92x~143.93i_1~118.93j~132.93j~143.93o_1~118.95s~132.95s~143.96c_1~118.96d~132.96d~143.96h_1~118.98n~132.98o~143.998_1~118.999~132.999~143.99b_1~118.9bj~132.9bj~143.9c1_1~118.9c2~132.9c2~143.9c4_1~118.9ee~132.9ef~143.9eu_1~118.9eu~132.9ev~143.9ex_1~118.9h8~132.9h8~143.9hm~118.9hn~132.9hn~143.9hq_1~118.9k3~132.9k3~143.9kf_1~118.9kg~132.9kg~143.9kj_1~118.9mx~132.9my~143.9n8_1~118.9n9~132.9n9~143.9nc_1~118.9ps~132.9pt~143.9q1~118.9q1~132.9q1~143.9q5_1~118.9sn~132.9so~143.9sv~118.9sw~132.9sw~143.9sz_1~118.9vi~132.9vi~143.9vo_1~118.9vp~132.9vp~143.9vs_1~118.9yf~132.9yf~143.9yr_1~143.9yv_1~118.9yx~132.9yx~118.a17~132.a18~143.a1k~118.a1k~132.a1k~143.a1o_1~118.a45~132.a45~143.a4f~118.a4g~132.a4g~143.a4h_1~118.a70~132.a70~143.a79_1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:21 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 401 event Show response
at.cbsi.com/lib/api/v1/ 90 B
236 B 849ms
848ms Fetch
application/json 151.101.65.188
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://at.cbsi.com/lib/api/v1/event

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.188 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend / Express

Resource Hash

c95bc774b2ae8b3d433382ce08d5ef2e7b0df69f848ab965a1fc4e141ef6b457

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept: application/json
cat: Dti-2Q90r
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 26 Mar 2020 16:47:21 GMT
via: 1.1 varnish
vary: Accept-Encoding
x-powered-by: Express
x-cache: MISS
status: 401
otest: at.cbsi.com
content-length: 90
x-served-by: cache-hhn4058-HHN
server: Google Frontend
x-timer: S1585241241.334127,VS0,VE620
etag: W/"5a-CpjAMoJvdVvGLSNHLetjYldfwPc"
strict-transport-security: max-age=300
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
x-cloud-trace-context: ae7f69453afd7d88f4ea520b07ec463e
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 0

GET
H2 200 / Show response
www.zdnet.com/homepage/xhr/ 244 KB
26 KB 152ms
152ms XHR
application/json 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/homepage/xhr/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

785df7dc67144409c22bfb395cf7b1b56e623f11897782eed6eb44f1283a08ec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 26100
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 26 Mar 2020 16:24:32 GMT
x-frame-options: SAMEORIGIN
date: Thu, 26 Mar 2020 16:47:23 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: d31f2ad6-d0d4-4fac-97b7-e2c9940a4e91
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 26 Mar 2020 17:54:32 GMT

GET
H2 200 ring.gif
zdnet1.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ 16 KB
9 KB 7ms
6ms Image
image/gif 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ring.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1285
status: 200
strict-transport-security: max-age=31536000
content-length: 9039
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:17:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd596-3f75"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:58 GMT

GET
H2 200 ZDLogoMicroRed-x2.png
zdnet1.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ 2 KB
2 KB 8ms
7ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1285
status: 200
strict-transport-security: max-age=31536000
content-length: 1513
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:17:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd596-6fa"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:58 GMT

GET
H2 200 ZDLogoMicroWhite-x2.png
zdnet4.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ 2 KB
2 KB 9ms
9ms Image
image/png 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1585239446-asset/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2030-fly/css/core/main-016a6e5a2e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1290
status: 200
strict-transport-security: max-age=31536000
content-length: 1398
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Mar 2020 16:17:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e7cd596-691"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Apr 2020 16:25:48 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame FF08 0
56 B 156ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=4~k88zp856&chm=1&ctx=2&qqid=COGm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgsYvnkgQyoECAISAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:23 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABA8 0
56 B 157ms
157ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=4~k88zp856&chm=1&ctx=2&qqid=COCm5-HLuOgCFZkW4AodXq4J4w&met.6=6.1_CgsYynkgQyoECAISAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:23 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 river-time-ago-438a4081b3-rev.js Show response
zdnet4.cbsistatic.com/fly/js/components/ 757 B
533 B 89ms
88ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-438a4081b3-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596931
status: 200
strict-transport-security: max-age=31536000
content-length: 424
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e726d7d-2f5"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:32 GMT

GET
H2 200 tr-premium-promo-e55876004f-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 467 B
459 B 8ms
8ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-e55876004f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596931
status: 200
strict-transport-security: max-age=31536000
content-length: 287
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e726d7d-1d3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:31 GMT

GET
H2 200 load-more-11b0ac1e21-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 4 KB
2 KB 8ms
8ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/load-more-11b0ac1e21-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596927
status: 200
strict-transport-security: max-age=31536000
content-length: 1679
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Mar 2020 18:50:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e726d7d-10fb"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Mar 2020 18:58:35 GMT

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
917 B 371ms
371ms XHR
application/json 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

72c66bfd58f3fc5668b71e058dee00a5cddcb7563b76dcfac799f9cb28ddfe46

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 763
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
date: Thu, 26 Mar 2020 16:47:24 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 154b741b-b831-4394-83ff-4317a99a2ccb
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 / Show response
www.zdnet.com/components/tr-promo-asset/xhr/ 2 KB
734 B 151ms
151ms XHR
application/json 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2030-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5dc9e7d2f16aeba5fbcb6b7155784f399056af88eb6e5fbb1ec79632bcc7e352

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 617
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 26 Mar 2020 15:59:00 GMT
x-frame-options: SAMEORIGIN
date: Thu, 26 Mar 2020 16:47:23 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: b0ff3d7f-7956-4192-9d97-0849d830ee87
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 26 Mar 2020 17:29:00 GMT

GET
H2 200 load-more-1.0.js Show response
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 8 KB
3 KB 19ms
19ms Script
application/javascript 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 517275
status: 200
strict-transport-security: max-age=31536000
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Thu, 19 Mar 2020 20:19:55 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e73d3eb-1f51"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Mar 2020 17:06:08 GMT

GET
H2 200 trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/ 3 KB
3 KB 8ms
8ms Image
image/jpeg 2a04:4e42:3::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 16:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 517205
status: 200
strict-transport-security: max-age=31536000
content-length: 3111
x-xss-protection: 1; mode=block
last-modified: Thu, 19 Mar 2020 20:18:30 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5e73d396-c82"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Mar 2020 17:07:12 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame CB54 0
56 B 157ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~k88zpdzo&c=3215668957805828&e=21065778%2C21062888%2C21065202%2C21065391&ctx=1&met.3=143.a7b_1~118.a7c~132.a7c~118.a9v~132.a9v~143.aa2~118.aa2~132.aa2~143.aa4_1~118.acp~132.acp~143.ad0_1~143.ad1_1~118.ad2~132.ad2~118.afj~132.afj~143.aft~118.aft~132.aft~143.afu_1~118.aie~132.aie~143.aio_1~143.aiq_2~118.ais~132.ais~118.al9~132.al9~143.alj_1~118.alk~132.alk~143.alk_1~118.ao4~132.ao4~143.aoe~143.aof_1~118.aog~132.aog~118.ar0~132.ar0~143.arc_1~143.ard_1~118.are~132.are~118.atv~132.atv~143.au5~118.au5~132.au5~143.au6_1~118.awp~132.awp~143.awy_1~118.awy~132.awz~143.awz_1~118.azj~132.azj~143.azr~118.azs~132.azs~143.azs_1~118.b2e~132.b2e~143.b2l~118.b2l~132.b2l~143.b2m_1~118.b5a~132.b5a~143.b5g~143.b5h_1~118.b5i~132.b5i~118.b83~132.b83~143.b89~118.b89~132.b89~143.b8a_1~118.bax~132.bax~143.bb4_1~143.bb5_1~118.bb6~132.bb6~118.bdr~132.bdr~143.bdx~118.bdx~132.bdx~143.bdy_1~118.bgk~132.bgk~143.bgq~118.bgr~132.bgr~143.bgr_1~118.bje~132.bje~143.bjk~143.bjl_1~118.bjl~132.bjm~118.bmi_1~132.bmj~143.bnj_2~143.bnm_4~118.bnv~132.bnv~118.bpd~132.bpd~143.bqe_1~118.bqf~132.bqf~143.bqi_2~143.btw_1~143.bty_2~118.bu0~132.bu0~118.bu3~132.bu4~118.bwm~132.bwm~143.bx1_1~143.bx2_1~118.bxa~132.bxa~118.bzg~132.bzg~143.bzu~118.bzv~132.bzv~143.bzv_1~118.c2a~132.c2a~143.c4v_1~143.c4w_1~118.c5n~132.c5o~118.c6p~132.c6p~143.c7z~143.c7z_1~118.c81~132.c81~118.c9d~132.c9d~143.cas_1~118.cas~132.cas~143.cat_1~118.cd3~132.cd3~143.cdl_1~118.cds~132.cdt~143.cdt_1~118.cfw~132.cfw~143.cgm~143.cgn_1~118.cgo~132.cgp~118.cis~132.cit~143.cjh_1~143.cjh_1~118.cji~132.cjj~118.clp~132.clp~143.cm9~118.cma~132.cma~143.cma_1~118.coj~132.coj~143.cp2~118.cp3~132.cp3~143.cp3_1~118.crd~132.cre~143.crx_1~143.cry_1~118.crz~132.crz~118.cu9~132.cu9~143.cuq_1~118.cur~132.cur~143.cur_1~118.cx5~132.cx6~143.cxj_1~118.cxk~132.cxk~143.cxk_1~118.d00~132.d01~143.d0f_1~143.d0f_4~118.d0j~132.d0j~118.d31~132.d32~143.d3c_1~143.d3g_3~118.d3i~132.d3j~118.d5v~132.d5v~143.d65_1~118.d66~132.d66~143.d6a_1~118.d8q~132.d8q~143.d8y_1~118.d8z~132.d8z~143.d94_1~118.dbl~132.dbl~143.dbr_1~118.dbs~132.dbs~143.dbx_1~118.def~132.def~143.dek_1~118.dek~132.del~143.der_1~118.dha~132.dha~143.dhi_1~118.dhk~132.dhk~143.dhk_1~118.dk3~132.dk3~143.dkc_2~118.dkj~132.dkj~143.dkj_1~118.dmy~132.dmy~143.dn6_1~118.dn7~132.dn7~143.dnc_1~118.dpt~132.dpt~143.dpz_1~118.dq0~132.dq0~143.dq5_1~118.dsm~132.dsm~143.dss_1~118.dst~132.dst~143.dsz_2~118.dvh~132.dvh~143.dvm~118.dvm~132.dvm~143.dvs_1~118.dyb~132.dyb~143.dyf~118.dyf~132.dyf~143.dym_1~118.e16~132.e16~143.e1c_1~118.e1e~132.e1e~143.e1f_1~118.e43~132.e43~143.e4c_1~143.e4d_1~118.e4h~132.e4h~118.e6y~132.e6y~143.e76_1~118.e76~132.e77~143.e77_1~118.ea4~132.ea4~143.ea9_1~143.ea9_1~118.eab~132.eab~118.ecv~132.ecw~143.edc_3~143.ede_1~118.edg~132.edg~118.efr~132.efr~143.eg6_1~118.eg7~132.eg7~143.eg7_2~118.eil~132.eil~143.eiz_1~118.ej0~132.ej0~143.ej1_1~118.elf~132.elg~143.els_1~118.elt~132.elt~143.elu_1~118.eoh~132.eoi~143.eoq_1~143.eor_1~118.eot~132.eot~118.erb~132.erc~143.erj~118.erj~132.erj~143.erk_1~118.eu6~132.eu6~143.euc_1~118.eud~132.eud~143.eud_1~118.ex0~132.ex0~143.ex5~118.ex5~132.ex5~143.ex6_1~118.ezw~132.ezw~143.f02_1~143.f02_1~118.f04~132.f04~118.f2q~132.f2q~143.f2v~118.f2w~132.f2w~143.f2w_1~143.f6b_1~143.f6c_a~118.f6n~132.f6o~118.f6s_1~132.f6t~118.f8y~132.f8z~143.f94~118.f94~132.f94~143.f9e_1~118.fbt~132.fbt~143.fbw~118.fbx~132.fbx~143.fc7_1~118.fem~132.fem~143.fep~118.fep~132.fep~143.ff0_1~118.fhg~132.fhg~143.fhj~118.fhk~132.fhk~143.fht_1~118.fka~132.fka~143.fkc~118.fkc~132.fkc~143.fkm_1~118.fn3~132.fn4~143.fn6~118.fn6~132.fn7~143.fnf_1~118.fpz~132.fpz~143.fq1~118.fq2~132.fq2~143.fq8_1~118.fst~132.fst~143.fsx~118.ft0~132.ft0~143.ft2_1~118.fvo~132.fvp~143.fvs_1~118.fvt~132.fvt~143.fvv_1~118.fyi~132.fyj~143.fyl~118.fym~132.fym~143.fyo_1~118.g1c~132.g1d~143.g1f~118.g1g~132.g1g~143.g1h_1~118.g47~132.g47~143.g4b_1~143.g4c_1~118.g4d~132.g4d~118.g72~132.g72~143.g75_1~143.g76_1~118.g77~132.g78~118.g9x~132.g9x~143.g9z~118.g9z~132.g9z~143.g9z_1~118.gcs~132.gcs~143.gcv_1~143.gcw_1~118.gcz~132.gcz~118.gfm~132.gfm~143.gfo~118.gfp~132.gfp~143.gfp_1~118.gih~132.gih~143.gij~143.gik_1~118.gim~132.gim~118.gld~132.gld~143.gll_1~143.glm_1~118.glq~132.glq~118.go8~132.go8~143.goe_1~118.gof~132.gof~143.gof_1~118.gr2~132.gr2~143.gr7~118.gr7~132.gr7~143.gr8_1~118.gtw~132.gtw~143.gu0~118.gu0~132.gu0~143.gu1_1~118.gwr~132.gwr~143.gwt~118.gwu~132.gwu~143.gwu_1~118.gzl~132.gzl~143.gzo_1~143.gzp_1~118.gzs~132.gzs~118.h2g~132.h2g~143.h2i_1~118.h2j~132.h2j~143.h2k_1~118.h5a~132.h5a~143.h5d~143.h5e_1~118.h5f~132.h5f~118.h84~132.h84~143.h87~118.h88~132.h88~143.h88_1~118.hay~132.hay~143.hb0~118.hb0~132.hb1~143.hb1_1~118.hds~132.hds~143.hdu~143.hdu_1~118.hdv~132.hdw~118.hgn~132.hgn~143.hgo~143.hgp~118.hgq~132.hgr~118.hjg~132.hjg~143.hjj~143.hjj~118.hjl~132.hjl~118.hma~132.hma~143.hmd~143.hmd~118.hme~132.hme~118.hp6~132.hp7~143.hp9~143.hp9_1~118.hpd~132.hpd~118.hrz~132.hrz~143.hs3~143.hs4_1~118.hs7~132.hs7~118.huv_2~132.hux~143.hv1_1~143.hv1_1~118.hv9~132.hv9~118.hxt~132.hxt~143.hxw_1~143.hxx_1~118.hxz~132.hxz~118.i0n~132.i0n~143.i0q~143.i0q_1~118.i0r~132.i0s~118.i3j~132.i3j~143.i3m~143.i3n_1~118.i3q~132.i3q~118.i6d~132.i6d~143.i6g~118.i6h~132.i6h~143.i6h_1~118.i9a~132.i9a~143.i9h_1~143.i9i_1~118.ia4~132.ia4~118.ic4~132.ic4~143.icc_1~143.icd_1~118.icf~132.icf~143.ifq~143.ifr_1~118.ifx~132.ifx~118.ifz~132.ifz~118.iil~132.iil~143.iim~143.iin_1~118.iio~132.iio~118.ilg~132.ilg~143.ilh_1~143.ili_1~118.ilj~132.ilj~118.ioa~132.iob~143.iob_1~143.ioc_1~118.ioe~132.ioe~118.ir4~132.ir4~143.ir5~143.ir5_1~118.ir7~132.ir7~118.itz~132.itz~143.iu0_1~143.iu1_1~118.iu2~132.iu3~118.iwu~132.iwv~143.iww_1~143.iwx_1~118.iwy~132.iwy~118.izw~132.izw~143.izx_1~143.izy_1~118.j07~132.j07~118.j2n~132.j2n~143.j2q_1~118.j2r~132.j2r~143.j2r_1~118.j5j~132.j5j~143.j5m_1~143.j5n_1~118.j5o~132.j5o~143.j8w_1~143.j8x_1~118.j91~132.j91~118.j94~132.j94~118.jbn~132.jbn~143.jbp_1~118.jbq~132.jbq~143.jbq_1~118.jeh~132.jeh~143.jei_1~118.jej~132.jej~143.jej_1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BFB3 0
56 B 157ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4t4&chm=1&ctx=2&qqid=CNym5-HLuOgCFZkW4AodXq4J4w&met.3=118.12d~118.12i~143.12p_1~118.14e~118.14i~143.15j_1~118.15k~118.16u~143.18c_1~118.18d~118.1a1~118.1ci~143.1cr_1~118.1d5~118.1df~118.1do~143.1fk_1~118.1fl~118.1gh~143.1id_1~118.1ie~118.1jb~143.1l6~118.1l6~118.1m5~143.1ny_1~118.1nz~118.1p1~143.1qr_1~118.1qt~118.1rw~143.1tk_1~118.1tl~118.1uq~143.1we_1~118.1wf~118.1xm~143.1z7_1~118.1z8~118.20g~143.220_1~118.221~118.23b~143.24t_1~118.24u~118.267~143.27p_1~118.27q~118.291~143.2ai_1~118.2ai~118.2bx~143.2df_1~118.2dg~118.2es~143.2g8_1~118.2ga~118.2hn~143.2j2_1~118.2j3~118.2kn~143.2lw_1~118.2lx~118.2ni~143.2op_1~118.2oq~118.2qe~143.2rk_1~118.2rm~118.2t9~143.2uf_1~118.2ug~118.2wa~143.2x9_1~118.2xa_1~118.2z5~143.302_1~118.303~118.31z~143.32v_1~118.32w~118.34v~143.35p_1~118.35r~118.37q~143.38j_1~118.38l~118.3an~143.3be_1~118.3bf~118.3di~143.3e7_1~118.3e9~118.3gc~143.3h1_1~118.3h2~118.3j9~143.3jv_1~118.3jx~118.3m3~143.3mo_1~118.3mp~118.3oz~143.3pi_1~118.3pj~118.3ru~143.3sd_1~118.3sg~118.3ux~143.3vc_1~118.3ve~118.3xp~143.3yl_1~118.3yo~143.433_2~118.45p~118.45x~143.476_1~118.483~118.48j~143.4dk~118.4dp~118.4du~118.4gd~143.4gj_1~118.4gn~118.4j7~143.4jf_1~118.4jh~118.4m3~143.4m9_1~118.4ma~118.4oz~143.4p3~118.4p3~118.4rt~143.4ry~118.4rz~118.4up~143.4ut_2~118.4ux~118.4xj~143.4xu_1~118.4xx~143.512_1~118.514~118.51w~118.53v~143.53z_1~118.541~118.56r~143.56u~118.56v~118.59l~143.59o_1~118.59q~118.5cg~143.5cj_1~118.5cl~118.5fc~143.5ff_1~118.5fh~118.5i8~143.5ib_1~118.5ic~118.5l3~143.5l6_1~118.5l7~118.5ny~143.5o0_1~118.5o1~118.5qt~143.5qy_1~118.5r0~118.5tr~143.5tu_1~118.5tw~118.5wm~143.5wr_1~118.5wu~118.5zp~143.5zs_1~118.5zx~118.62l~143.62n_1~118.62p~143.65m_1~118.65n~118.65x~118.68h~143.68k_1~118.68m_1~118.6bd~143.6be~118.6bf~118.6e8~143.6e9_1~118.6eb~118.6h2~143.6h4_1~118.6h7~118.6jw~143.6jy_1~118.6k1~118.6ms~143.6mu_1~118.6mv~118.6pn~143.6pp_1~118.6pr~118.6sh~143.6si~118.6sj~118.6vc~143.6vd_1~118.6vf~118.6y6~143.6y7~118.6y8~118.70z~143.711~118.712~118.73u~143.73x_1~118.740~118.76o~143.76q_1~118.76r~118.79j~143.79k_1~118.79n~118.7cd~143.7ce~118.7ce~118.7f8~143.7f9_1~118.7fc~118.7i2~143.7i3~118.7i4~118.7ky~143.7l0_5~118.7l7~118.7nt~143.7nx_1~118.7ny~118.7qo~143.7qq_1~118.7qr_4~118.7tj~143.7uc_1~118.7uh~118.7wf~143.7x5_1~118.7x6~118.7zc~143.7zy_1~118.7zz~118.827~143.82r_1~118.82t~118.852~143.85l_1~118.85l~118.87w~143.88e~118.88e~118.8ar~143.8b6~118.8b7~118.8dl~143.8dz_1~118.8dz~118.8gf~143.8gr_1~118.8gs~118.8j9~143.8jk_1~118.8jl~118.8m4~143.8md_1~118.8md~118.8oy~143.8p5~118.8p6~118.8s2_1~143.8s5_1~118.8s9~118.8ux~143.8v0_1~118.8v0~118.8xr~143.8xs~118.8xt~118.90m~143.90n~118.90o~118.93h~143.93i_1~118.93k~118.96b~143.96c~118.96e~118.997~143.999_1~118.99b~118.9c2~143.9c4_1~118.9c6~118.9ey~143.9f0_1~118.9f2~118.9hs~143.9ht~118.9hu~118.9kn~143.9ko_1~118.9kt~118.9nh~143.9nj_1~118.9nl~118.9qc~143.9qd_1~118.9qg~118.9t7~143.9t9_1~118.9tb~118.9w1~143.9w2~118.9w3~143.9yx_1~118.9yz~118.9z1~118.a1r~143.a1s~118.a1t~118.a4o~143.a4q_1~118.a4x~118.a7j~143.a7l_1~118.a7n~118.aaf~143.aag_1~118.aah~118.ad9~143.ada_1~118.adc~118.ag3~143.ag4~118.ag5~118.aiy~143.aj0_1~118.aj3~118.alt~143.alu_1~118.alx~118.aoo~143.aop_1~118.aot~118.ark~143.arl_1~118.arn~118.auf~143.aug_1~118.aui~118.ax9~143.axb~118.axd~118.b03~143.b04_1~118.b07~118.b2y~143.b2z~118.b31~118.b5t~143.b5v_1~118.b5x~118.b8n~143.b8o_1~118.b8q~118.bbh~143.bbi~118.bbj~118.beb~143.beb~118.bec~118.bh4~143.bh5~118.bh6~118.bjy~143.bjz~118.bk0~118.bn0_1~143.bnc_3~118.bnk~118.bpw~143.bq6_1~118.bq7~143.bu8_1~118.buj~118.bul~118.bx5~143.bx7_1~118.bxd~118.bzz~143.c01_1~118.c02~118.c2t~143.c2u~118.c2w~143.c72~118.c78~118.c7a~118.c9x~143.c9y_1~118.ca1~143.cdk_1~118.cdm~118.cdo~118.cgf~143.cgh_1~118.cgj~118.cjc~143.cje_1~118.cjj~118.cm8~143.cma_1~118.cmb~118.cp3~143.cp4_1~118.cp6~118.crx~143.crz_1~118.cs1~118.cus~143.cuu_1~118.cux~118.cxp~143.cxr_3~118.cxy~118.d0k~143.d0o_1~118.d0p~143.d3k_1~118.d3l~118.d3n~118.d6f~143.d6h_1~118.d6i~118.d9a~143.d9b_1~118.d9c~118.dc4~143.dc6_1~118.dc8~118.dez~143.df0_1~118.df2~118.dhu~143.dhw~118.di1~118.dkn~143.dkp_1~118.dkp~118.dni~143.dnj_1~118.dnk~118.dqc~143.dqe~118.dqg~118.dt6~143.dt7~118.dt8~118.dw1~143.dw2_1~118.dw5~118.dyv~143.dyw_1~118.dyx~118.e1q~143.e1r_1~118.e1t~118.e4n~143.e4t_1~118.e4v~118.e7i~143.e7l_1~118.e7m~118.eao~143.eap_1~118.ear~118.edf~143.edj_1~118.edt~118.egb~143.egc_1~118.egd~118.ej5~143.ej6~118.ej6~118.elz~143.em0~118.em1~143.ep0_1~118.ep1~118.ep5~118.erv~143.erw_1~118.erx~118.euq~143.eur_1~118.eut~118.exk~143.exl~118.exl~118.f0g~143.f0h_1~118.f0j~118.f39~143.f3b_1~118.f3c~143.f6s_2~118.f77~118.f7b~118.f9i~143.f9m~118.f9n~118.fcd~143.fcf~118.fcf~118.ff6~143.ff7~118.ff8~118.fi0~143.fi2_1~118.fi4~118.fku~143.fkv~118.fkv~118.fnn~143.fnp~118.fnq~118.fqj~143.fqk~118.fqm~118.ftd~143.fte~118.fth~118.fw8~143.fwa_1~118.fwd~118.fz2~143.fz4_1~118.fz5~118.g1w~143.g1y_1~118.g20~118.g4r~143.g4t_1~118.g4w~118.g7m~143.g7o_1~118.g7q~118.gah~143.gai~118.gaj~118.gdc~143.gde_1~118.gdh~118.gg6~143.gg7~118.gg8~118.gj1~143.gj2_1~118.gj5~118.glw_1~143.gm5_1~118.gma~118.gos~143.goy_1~118.goy~118.grm~143.grq~118.grr~118.gug~143.guj~118.guk~118.gxa~143.gxc~118.gxe~118.h05~143.h08_1~118.h0c~118.h2z~143.h31~118.h33_1~118.h5u~143.h5w~118.h5y~118.h8o~143.h8q~118.h8s~118.hbi~143.hbk~118.hbk~118.hec~143.hed~118.hef~118.hh7~143.hh8~118.hha~118.hk0~143.hk2~118.hk4~118.hmu~143.hmw_1~118.hmy~118.hpq~143.hpt~118.hpx~118.hsj~143.hsn~118.hsp~118.hvf~143.hvk_1~118.hvs~118.hyd~143.hyf_1~118.hyj~118.i17~143.i19~118.i1b~118.i43~143.i46~118.i4a~118.i6x~143.i70_1~118.i71~118.i9t~143.ia0_1~118.iao~118.ico~143.icv~118.icy~143.igd_1~118.igg~118.igl~118.ij5~143.ij8_1~118.ija~118.im0~143.im4_1~118.im6~118.iou~143.ioy_1~118.ip1~118.iro~143.irs_1~118.irt~118.iuj~143.iun_1~118.iuq~118.ixe~143.ixj_1~118.ixm~118.j0d_1~143.j0r_1~118.j16~118.j37~143.j3l_1~118.j3m~118.j63~143.j6e_1~118.j6f~143.j9j_1~118.j9k~118.j9q~118.jc7~143.jcd~118.jce~118.jf1~143.jf6_1~118.jf6~118.jhv~143.jhy~118.jhz~118.jkp~143.jks~118.jkt
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 40C6 0
47 B 157ms
157ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4w7&chm=1&ctx=2&qqid=CN-m5-HLuOgCFZkW4AodXq4J4w&met.3=118.13o~143.147_1~118.149~118.160~143.170_1~118.171~118.197~143.1an_1~118.1bo~118.1bo~118.1ca~118.1cu~143.1dt_1~118.1dw~118.1fo~143.1h2_1~118.1h5~118.1ih~143.1jv_1~118.1jw~118.1lc~143.1mo_1~118.1mv~118.1o8~143.1pi_1~118.1pj~118.1r2~143.1sb_1~118.1sc~118.1tw~143.1v4_1~118.1v5~118.1ws~143.1xx_1~118.1xy~118.1zm~143.20q_1~118.20r~118.22i~143.23j_1~118.23k~118.25d~143.26c_1~118.26c~118.287~143.294_1~118.295~118.2b3~143.2bx_1~118.2by~118.2dx~143.2eq_1~118.2er~118.2gt~143.2hj_1~118.2hj~118.2jt~143.2kc_1~118.2kc~118.2mo~143.2n4_1~118.2n5~118.2pk~143.2q0_1~118.2q0~118.2sg~143.2ss_1~118.2su~118.2vg~143.2vm_1~118.2vn~118.2yb~143.2yj_1~118.2yl_1~118.315~143.31c_1~118.31d~118.341~143.345_1~118.346~118.36w~143.372_1~118.374~118.39t~143.39x~118.39z~118.3cn~143.3cr_1~118.3cu~118.3fi~143.3fn_1~118.3fq~118.3if~143.3ik_1~118.3im~118.3l9~143.3le_1~118.3lf~118.3o5~143.3o9_1~118.3ob~118.3r0~143.3r4_1~118.3r7~118.3u3~143.3ua_1~118.3uf~118.3wv~143.3x4_1~118.3x6~143.44t_1~118.453~118.460~118.47p~143.4bw_1~118.4cq~118.4cx~143.4f1_1~118.4f3~118.4fj~143.4hu_1~118.4hv~118.4id~143.4kn~118.4kn~118.4l9~143.4ng~118.4nh~118.4o5~143.4q8~118.4q9~118.4qz~143.4t4_1~118.4t7~118.4tv~143.4vx_1~118.4vy~118.4wp~143.4yx_1~118.4yz~118.50c~143.523_1~118.52a~118.532~143.54w~118.54x~118.55x~143.57q_1~118.57r~118.58r~143.5ak_1~118.5al~118.5bn~143.5dd_1~118.5de~118.5ei~143.5g6_1~118.5g7~118.5he~143.5iz_1~118.5j0~118.5k9~143.5lt_1~118.5lu~118.5n3~143.5on_1~118.5op~118.5pz~143.5rg_1~118.5rh~118.5sx~143.5u9_1~118.5ua~118.5vs~143.5x3_1~118.5x4~118.5yv~143.5zw_1~118.5zx~118.61r~143.62p_1~118.62q~118.64x~143.65m_1~118.65n~118.67n~143.68i_1~118.68k~118.6aj~143.6bd_1~118.6bj~118.6dd~143.6e8_1~118.6e9~118.6g8~143.6h1_1~118.6h2~118.6j2~143.6ju_1~118.6jv~118.6ly~143.6mn_1~118.6mn~118.6ot~143.6pg~118.6pg~118.6rn~143.6s8_1~118.6s9~118.6ui~143.6v4_1~118.6v6~118.6xb~143.6xx_1~118.6xy~118.705~143.70q_1~118.70r~118.730~143.73j_1~118.73k~118.75u~143.76c_1~118.76d~118.78o~143.796~118.797~118.7bi~143.7bz_1~118.7c0~118.7ee~143.7es_1~118.7es~118.7h7~143.7hk_1~118.7hl~118.7k3~143.7kk_1~118.7kq~118.7mz~143.7nd_1~118.7ne~118.7pu~143.7qb_1~118.7qd~118.7sr_3~143.7tr_1~118.7tz~118.7vo~143.7wj~118.7wk~118.7yj~143.7zc_1~118.7zd~118.81c~143.825~118.825~118.848~143.84x_1~118.84z~118.872~143.87v_1~118.87w~118.89x~143.8an_1~118.8ao~118.8cq~143.8dg~118.8dg~118.8fl~143.8g8_1~118.8g9~118.8if~143.8j1_1~118.8j2~118.8la~143.8m3_1~118.8m7~118.8o4~143.8p1_2~118.8pe_1~118.8r9~143.8rw_1~118.8rx~118.8u2~143.8up_1~118.8up~118.8wx~143.8xh~118.8xi~118.8zr~143.90a~118.90a~118.92n~143.932~118.933~118.95h~143.95v~118.95v~118.98d~143.98o_1~118.98o~118.9b8~143.9bh_1~118.9bh~118.9e4~143.9ea~118.9ea~118.9gy~143.9h2~118.9h2~118.9jt~143.9jz_1~118.9k2~118.9mn~143.9mu_1~118.9mv~118.9pi~143.9po_1~118.9pp~118.9sd~143.9sj~118.9sl~118.9v7~143.9vc_1~118.9vc~118.9y4~143.9ye_1~118.9yl~118.a0x~143.a17_1~118.a18~118.a3u~143.a44_1~118.a45~118.a6p~143.a6x_1~118.a6y~118.a9k~143.a9q~118.a9q~118.ace~143.acm_1~118.acq~118.af8~143.aff_1~118.afg~118.ai4~143.aib_1~118.aie~118.akz~143.al7~118.al9~118.anu~143.ao2_1~118.ao4~118.aqq~143.ar0_1~118.ar3~118.atl~143.att~118.att~118.awf~143.awl_1~118.awm~118.az9~143.azf~118.azg~118.b24~143.b29~118.b2a~118.b4z~143.b54_1~118.b57~118.b7t~143.b7x~118.b7y~118.ban~143.bas_1~118.bau~118.bdg~143.bdl_1~118.bdl~118.bga~143.bge_1~118.bgf~118.bj3~143.bj8_1~118.bja~118.bm9_5~143.bn3_2~118.bnj~118.bp2~143.bpy_1~118.bpz~143.btk_1~118.btq~118.bts~118.bwb~143.bwo_1~118.bww~118.bz5~143.bzh_1~118.bzi~118.c1z~143.c4i_1~118.c59~118.c6e~143.c7n_1~118.c7q~118.c93~143.cag_1~118.cah~118.cct~143.cd9_1~118.cda~118.cfl~143.cgb_1~118.cgc~118.cii~143.cj5_1~118.cj7~118.cle~143.cly~118.clz~118.co9~143.cor_1~118.cor~118.cr3~143.crl_1~118.crn~118.cty~143.cue_1~118.cuf~118.cwv~143.cx7_1~118.cx8~118.czq~143.d03_1~118.d08~118.d2r~143.d34_1~118.d38~118.d5l~143.d5x_1~118.d5y~118.d8f~143.d8q_1~118.d8r~118.dba~143.dbj_1~118.dbj~118.de4~143.deb_1~118.dec~118.dgz~143.dh8_1~118.dh9~118.djt~143.dk4_4~118.dk9~118.dmo~143.dn0_1~118.dn1~118.dpi~143.dpt_1~118.dpu~118.dsc~143.dsm_1~118.dsm~118.dv7~143.dve_1~118.dvf~118.dy1~143.dy7_1~118.dy8~118.e0w~143.e12_1~118.e13~118.e3t~143.e45_1~118.e47~118.e6o~143.e6y_1~118.e6y~118.e9u~143.e9x_1~118.ea0~118.ecl_2~143.ed0_1~118.ed5~118.efh~143.eft_2~118.efv~118.eia~143.ein_1~118.ein~118.el5~143.elf_1~118.elg~118.eo7~143.eoc~118.eog~118.er1~143.er6_1~118.er7~118.etw~143.etz~118.eu1~118.ewp~143.ews~118.ews~118.ezl~143.ezp_1~118.ezt~118.f2f~143.f2j~118.f2k~143.f5i_1~118.f5u~118.f6d~143.f8a~118.f8b~118.f8o~143.fb3~118.fb3~118.fbi~143.fdv~118.fdw~118.fec~143.fgo_1~118.fgp~118.fh6~143.fjh~118.fjh~118.fjz~143.fm9~118.fma~118.fmt~143.fp2_1~118.fp3~118.fpp~143.frv~118.frv~118.fsj~143.fun_1~118.fuo~118.fve~143.fxg_1~118.fxh~118.fy8~143.g09~118.g09~118.g12~143.g31_1~118.g32~118.g3x~143.g5w_1~118.g5y~118.g6s~143.g8p_1~118.g8q~118.g9m~143.gbi_1~118.gbj~118.gch~143.geb_1~118.gec~118.gfc~143.gh4_1~118.gh5~118.gi6~143.gjx_1~118.gjx~118.gl3~143.gmp_1~118.gmq~118.gnx~143.gpi_1~118.gpj~118.gqs~143.gsb_1~118.gsc~118.gtm~143.gv4~118.gv4~118.gwg~143.gxw_1~118.gxx~118.gzb~143.h0p_1~118.h0q~118.h25~143.h3i_1~118.h3i~118.h50~143.h6a_1~118.h6b~118.h7u~143.h93~118.h93~118.han~143.hbv~118.hbw~118.hdh~143.heo~118.hep~118.hgc~143.hhh_1~118.hhh~118.hj6~143.hk9_1~118.hka~118.hm0~143.hn3_1~118.hn3~118.how~143.hpv_1~118.hpw~118.hro~143.hso_1~118.hsp~118.hun~143.hvh_1~118.hvi~118.hxj~143.hya_1~118.hyb~118.i0d~143.i13_1~118.i13~118.i39~143.i3v_1~118.i3w~118.i63~143.i6o~118.i6p~118.i8z~143.i9v_1~118.i9x~118.ibu~143.ico_1~118.icp~118.ifn~143.ifp_1~118.ifr~118.iib~143.iih_1~118.iii~118.il6~143.ilc_1~118.ile~118.io0~143.io7_1~118.io8~118.iqu~143.ir0~118.ir2~118.itp~143.itw~118.itz~118.iwk~143.iws_1~118.iwu~118.izm~143.j07_3~118.j0d~118.j2d~143.j32_1~118.j33~118.j59~143.j5v_1~118.j5v~118.j8q~143.j8v~118.j8w~118.jbc~143.jbo_1~118.jbs~118.je7~143.jeh_1~118.jei~118.jh0~143.jha~118.jha~118.jjv~143.jk3
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame FF08 0
47 B 207ms
206ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=5~k88zpfx1&chm=1&ctx=2&qqid=COGm5-HLuOgCFZkW4AodXq4J4w&met.3=118.102~118.11j~143.11k_1~118.121~118.13u~143.14e_1~118.14f~118.172~143.17e_2~118.17q~118.19i~118.1a5~143.1ai_1~118.1ap~118.1aq~143.1dg_1~118.1dj~118.1dk~118.1gc~143.1gd_1~118.1gf~118.1j7~143.1j9_1~118.1jb~118.1m3~143.1m4_1~118.1m6~118.1ow~143.1ox~118.1oy~118.1rr~143.1rs~118.1rt~118.1un~143.1uo~118.1up~118.1xg~143.1xh_1~118.1xj~118.20d~143.20f_1~118.20i~118.238~143.239_1~118.23a~118.262~143.263~118.264~118.28x~143.28z_1~118.291~118.2bs~143.2bt~118.2bu~118.2eo~143.2ep_1~118.2eu_2~118.2ho~143.2hp_1~118.2hr~118.2ki~143.2kk_1~118.2km~118.2nf~143.2ng_1~118.2nl~118.2qa~143.2qc_1~118.2qf~118.2tb~143.2td_1~118.2tf~118.2w7~143.2w8_1~118.2wd_1~118.2z0~143.2z2_1~118.2z4~118.31w~143.31x_1~118.31y~118.34q~143.34t_1~118.34w~118.37n~143.37o~118.37p~118.3ai~143.3aj~118.3al~118.3dd~143.3de_1~118.3di~118.3ga~143.3gc_1~118.3gg~118.3j4~143.3j5_1~118.3j6~118.3m0~143.3m1_1~118.3m4~118.3ov~143.3ow_1~118.3oz~143.3rw_1~118.3ry~118.3s7~118.3uq~143.3us_1~118.3uu~246.3zs_1~143.42k_1~118.42y~118.43u~118.45k~143.49q_1~246.4ac~118.4ak~118.4as~143.4cv_1~118.4cx~118.4de~143.4fo_1~118.4fo~118.4g7~143.4ig~118.4ih~118.4j4~143.4l9_1~118.4la~118.4lz~143.4o2~118.4o3~118.4ou~143.4qw_2~118.4r0~118.4rq~143.4tr_1~118.4ts~118.4uj~143.4wq_1~118.4wt~118.4y7~143.4zx_1~118.4zz_4~118.50w~143.52q~118.52q~118.53s~143.55j_1~118.55l~118.56l~143.58d_1~118.58f~118.59h~143.5b6_1~118.5b7~118.5cd~143.5dz_1~118.5e0~118.5f9~143.5gs_1~118.5gt~118.5i3~143.5jm_1~118.5jo~118.5ky~143.5mg_1~118.5mi~118.5nu~143.5p9_1~118.5pa~118.5qs~143.5s3_1~118.5s4~118.5tn~143.5uw_1~118.5ux~118.5wq~143.5xp_1~118.5xq~118.5zm~143.60i_1~118.60j~118.62r~143.63b_1~118.63c~118.65i~143.664_1~118.665_2~118.68e~143.690_1~118.691~118.6b8~143.6bt_1~118.6bu_1~118.6e3~143.6ep_1~118.6eq~118.6gx~143.6hi_1~118.6hj~118.6jt~143.6kb~118.6kc~118.6mo~143.6n4~118.6n4~118.6pi~143.6pw~118.6px~118.6sc~143.6sq_1~118.6sr~118.6v6~143.6vj_1~118.6vk~118.6y0~143.6yc_1~118.6yd~118.70u~143.715_1~118.715~118.73p~143.73x~118.73y~118.76j~143.76q~118.76q~118.79d~143.79i~118.79j~118.7c8~143.7cd_1~118.7ce~118.7f2~143.7f7_1~118.7f8~118.7hz~143.7ic_1~118.7ik~118.7ku~143.7l6_1~118.7l7~118.7np~143.7o5_1~118.7o6~118.7qz_5~143.7rj_1~118.7ru~118.7tj~143.7uc~118.7uc~118.7we~143.7x5_1~118.7x5~118.7z7~143.7zy~118.7zy~118.823~143.82q_1~118.82r~118.84w~143.85l~118.85p~118.87r~143.88e_1~118.88f~118.8al~143.8b7_1~118.8b8~118.8df~143.8e0~118.8e0~118.8ga~143.8gt_1~118.8gt~118.8j4~143.8ju_1~118.8k0~118.8lz~143.8ms_3~118.8n0~118.8p4~143.8pn_1~118.8po~118.8rx~143.8sh_1~118.8sh~118.8ur~143.8v9~118.8va~118.8xm~143.8y2_1~118.8y2~118.90h~143.90u~118.90v~118.93c~143.93n~118.93n~118.968~143.96h~118.96i~118.993~143.99a_1~118.99b~118.9bz~143.9c3~118.9c4~118.9es~143.9ew~118.9ew~118.9ho~143.9hs_1~118.9hx~118.9ki~143.9kn_1~118.9kp~118.9nd~143.9nh_1~118.9nj~118.9q8~143.9qd~118.9qf~118.9t2~143.9t5_1~118.9t6~118.9vz~143.9w1~118.9wb~118.9ys~143.9yw_1~118.9yx~118.a1p~143.a1x~118.a20~118.a4k~143.a4r_1~118.a4s~118.a7f~143.a7k~118.a7k~118.aa9~143.aae_2~118.aak~118.ad3~143.ad8_1~118.ad9~118.afz~143.ag4_1~118.ag7~118.aiu~143.aj1_1~118.aj3~118.alo~143.alv_1~118.aly~118.aok~143.aot_1~118.aox~118.arf~143.arm_1~118.arn~118.aua~143.auf_1~118.aug~118.ax4~143.ax9~118.axa~118.azy~143.b03~118.b04~118.b2u~143.b2y~118.b31~118.b5n~143.b5r~118.b5r~118.b8h~143.b8m_1~118.b8o~118.bbb~143.bbe_1~118.bbf~118.be4~143.be7_1~118.be8~118.bgy~143.bh2_1~118.bh3~118.bk9_1~143.bku_3~118.blc~118.bmx~143.bnp_1~118.bnq~143.brb_1~118.brl~118.brm~118.bu6~143.buc_1~118.bun~118.bx0~143.bx4~118.bx5~118.bzu~143.c1t_1~246.c27_1~118.c29~118.c49~143.c4m_1~118.c4n~118.c6y~143.c7h_1~118.c7i~143.cak_1~118.cao~118.cao~118.cdg~143.cdh_1~118.cdk~118.cgd~143.cge_1~118.cgk~118.cj9~143.cja~118.cjb~118.cm3~143.cm4_1~118.cm6~118.coy~143.coz_1~118.cp2~118.crt~143.cru_1~118.cry~118.cuq~143.cuu_2~118.cuz~118.cxl~143.cxo_1~118.cxp~118.d0m~143.d0m_1~118.d0s~118.d3g~143.d3h_1~118.d3i~118.d6a~143.d6b_1~118.d6c~118.d95~143.d96_1~118.d97~118.dbz~143.dc0~118.dc2~118.deu~143.dew_1~118.df2~118.dhn~143.dhp_1~118.dhq~118.dki~143.dkj~118.dkl~118.dnd~143.dne~118.dnf~118.dq6~143.dq7~118.dq8~118.dt2~143.dt3~118.dt5~118.dvv~143.dvw~118.dvx~118.dyq~143.dys_1~118.dyw~118.e1s~143.e1t_1~118.e1y~118.e4i~143.e4m_1~118.e4m~118.e7o~143.e7p~118.e7s~118.eai~143.eaj_9~118.eau~118.edb~143.edk_1~118.edl~118.eg5~143.egd_1~118.ege~118.ej0~143.ej7_1~118.ej9~118.em2~143.em5_1~118.em7~118.eow~143.eox_1~118.eoy~118.err~143.ers~118.ert~118.euk~143.eul~118.eul~118.exg~143.exh_1~118.exl~118.f0a~143.f0b_1~118.f0c~143.f3o_3~118.f48~118.f4a~118.f6j~143.f6j_1~118.f6k~118.f9d~143.f9d_1~118.f9e~118.fc6~143.fc6~118.fc7~118.ff0~143.ff1_1~118.ff2~118.fhu~143.fhu~118.fhu~118.fko~143.fko_1~118.fkq~118.fnj~143.fnj~118.fnl~118.fqd~143.fqe~118.fqh~118.ft9~143.ft9_1~118.ftc~118.fw3~143.fw3_1~118.fw4~118.fyx~143.fyx~118.fyz~118.g1r~143.g1s_1~118.g1v~118.g4m~143.g4n_1~118.g4p~118.g7h~143.g7h~118.g7i~118.gac~143.gac_1~118.gag~118.gd6~143.gd7~118.gd8~118.gg1~143.gg1_1~118.gg4~118.giy~143.gj1_1~118.gj5~118.gls~143.glu_1~118.glu~118.gon~143.gon_1~118.goo~118.grg~143.grh~118.grh~118.gub~143.gub~118.guc~118.gx6~143.gx6_1~118.gx9~118.h00~143.h00~118.h01~118.h2u~143.h2v_1~118.h2x~118.h5o~143.h5p_1~118.h5q~118.h8i~143.h8i~118.h8j~118.hbc~143.hbc~118.hbe~118.he7~143.he7~118.he9~118.hh0~143.hh1~118.hh3~118.hju~143.hju~118.hjw~118.hmr~143.hmr_1~118.hmu~118.hpj~143.hpk_1~118.hpk~118.hsh~143.hsi_1~118.hsm~118.hvd~143.hve_1~118.hvg~118.hy7~143.hy8_1~118.hy9~118.i14~143.i14_1~118.i17~118.i3x~143.i3y_1~118.i3z~118.i6u~143.i6v_5~118.i72~118.i9o~143.i9u_1~118.i9w~143.idc_1~118.idi~118.idk~118.ig6~143.ig7~118.ig9~118.ij0~143.ij2_1~118.ij5~118.ilv~143.ilx_1~118.ilz~118.ioo~143.ior~118.ios~118.irj~143.irl_1~118.iro~118.iuf~143.iui_1~118.ium~118.ixg~143.ixj_7~118.iy5~118.j07~143.j0j_1~118.j0k~118.j34~143.j3c_1~118.j3d~143.j6i_1~118.j6l~118.j6q~118.j97~143.j9b_1~118.j9d~118.jc1~143.jc5~118.jc5~118.jev~143.jex~118.jex~118.jhq~143.jhr~118.jhs~118.jkk
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABA8 0
56 B 158ms
157ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=5~k88zpfx1&chm=1&ctx=2&qqid=COCm5-HLuOgCFZkW4AodXq4J4w&met.3=143.10f_1~118.11t~118.11v~143.140~118.144~118.146~143.173_1~118.17c~118.17d~118.19u~118.1ah~143.1al_1~118.1az~118.1b0~143.1dh_1~118.1di~118.1dv~143.1gc_1~118.1gd~118.1go~143.1j6_1~118.1j7~118.1ji~143.1m1_1~118.1m2~118.1me~143.1ou_1~118.1ov~118.1p8~143.1rn_1~118.1rp~118.1s3~143.1ug_1~118.1uh~118.1uy~143.1x9_1~118.1x9~118.1xs~143.201_1~118.202~118.20p~143.22u~118.22v~118.23k~143.25n~118.25n~118.26e~143.28f_1~118.28g~118.299~143.2b8_1~118.2b9~118.2c4~143.2e2_1~118.2e2~118.2f0~143.2gx_1~118.2gy~118.2i0~143.2jq_1~118.2jr~118.2ku~143.2mj_1~118.2mk~118.2nq~143.2pc_1~118.2pd~118.2qm~143.2s6_1~118.2s7~118.2tn~143.2v0_1~118.2v1~118.2wi~143.2xt_1~118.2xu~118.2zc~143.30m_1~118.30n~118.327~143.33f_1~118.33f~118.352~143.367_1~118.368~118.37z~143.390_1~118.391~118.3au~143.3bt~118.3bt~118.3dp~143.3em_1~118.3en~118.3gm~143.3hh_1~118.3hi~118.3jg~143.3ke_1~118.3kf~118.3mc~143.3n7_1~118.3n8~118.3p7~143.3q0_1~118.3q0~118.3sa~143.3su_1~118.3sv~118.3v2~143.3vy_1~118.3w0~246.406_1~143.409_1~118.426~118.43a~143.449_1~118.451~118.45v~246.4ao~143.4at~118.4b4~118.4b5~118.4dq~143.4dr_1~118.4dw~118.4gj~143.4gn_1~118.4gr~118.4jg~143.4jh~118.4jh~118.4mb~143.4mc~118.4me~118.4p5~143.4p8~118.4pa~118.4s1~143.4s3~118.4s7~118.4uv~143.4uw_1~118.4v1~143.4yc_1~118.4yj~118.4z7~118.518~143.51a_1~118.51c~118.543~143.545_1~118.546~118.56x~143.56y_1~118.571~118.59t~143.59u_1~118.59w~118.5cp~143.5cq_1~118.5cs~118.5fl~143.5fm_1~118.5fo~118.5if~143.5ig_1~118.5ii~118.5la~143.5lb_1~118.5ld~118.5o6~143.5o7_3~118.5ob~118.5r3~143.5r5_1~118.5r7~118.5ty~143.5u0_1~118.5u5~118.5x2~143.5x3_1~118.5x8~118.5zy~143.600_1~118.601~118.633~143.634_1~118.63a~118.65u~143.660_1~118.661~118.68q~143.68t_1~118.68u~118.6bk~143.6bm~118.6bn~118.6ef~143.6eh_1~118.6ej~118.6h9~143.6hd_1~118.6he~118.6k5~143.6k7~118.6k7~118.6n0~143.6n2_1~118.6n4~118.6pu~143.6pv~118.6pw~118.6so~143.6sq_1~118.6ss~118.6vi~143.6vj~118.6vk~118.6yc~143.6yd_1~118.6yf~118.716~143.71a_1~118.71c~118.741~143.743~118.744~118.76v~143.76y~118.771~118.79p~143.79r~118.79r~118.7ck~143.7cm_1~118.7co~118.7fe~143.7ff~118.7fg~118.7ia~143.7ih_1~118.7ip~118.7l6~143.7le~118.7lg~118.7o1~143.7o9_1~118.7oa~118.7r0_b~143.7rt_1~118.7s5~118.7tu~143.7ul~118.7um~118.7wq~143.7xe_1~118.7xf~118.7zj~143.807~118.807~118.82f~143.82z_1~118.830~118.858~143.85u_1~118.85w~118.883~143.88n~118.88o~118.8ax~143.8bg_1~118.8bh~118.8dr~143.8e9_1~118.8ea~118.8gm~143.8h2_1~118.8h2~118.8jg~143.8jv_1~118.8k4~118.8mb~143.8mo~118.8mo~118.8pg~143.8pm_1~118.8pp~118.8s9~143.8sf~118.8sg~118.8v3~143.8v8~118.8v8~118.8xy~143.8y0~118.8y1~118.90t~143.90w~118.90w~118.93o~143.93q_1~118.93r~118.96k~143.96m~118.96n~118.99f~143.99h~118.99i~118.9cb~143.9cd~118.9ce~118.9f4~143.9f6~118.9f6~118.9hz~143.9i2_1~118.9i6~118.9ku~143.9kx~118.9kz~118.9np~143.9nr_1~118.9nt~118.9qk~143.9qm_1~118.9qp~118.9te~143.9tf~118.9tg~118.9wb~143.9wc~118.9wm~118.9z3~143.9z5~118.9z7~118.a21~143.a23_5~118.a2a~118.a4w~143.a50_1~118.a51~118.a7r~143.a7t~118.a7u~118.aal~143.aan~118.aap~118.adf~143.adh~118.adi~118.aga~143.age_1~118.agh~118.aj5~143.aj9_1~118.ajc~118.am0~143.am5_1~118.am7~118.aow~143.aoz~118.ap2~118.arr~143.art_1~118.arv~118.aum~143.auo_1~118.aup~118.axf~143.axj_1~118.axl~118.b0a~143.b0d~118.b0e~118.b36~143.b38~118.b3b~118.b5z~143.b61~118.b62~118.b8t~143.b8v~118.b8x~118.bbn~143.bbo~118.bbp~118.beg~143.bei~118.bej~118.bha~143.bhb~118.bhd~118.bkk_1~143.bkw_2~118.blm~118.bn9~143.bnr_1~118.bns~143.bro_1~118.brw~118.bry~118.bui~143.bup_1~118.buz~118.bxc~143.bxh~118.bxi~118.c06~246.c2j~143.c2k_1~118.c33~118.c4l~143.c5d_1~118.c5d~118.c79~143.c85_1~118.c86~118.caz~143.cb0_1~118.cb3~118.cds~143.cdv_1~118.cdx~118.cgp~143.cgu_1~118.cgx~118.cjl~143.cjn_1~118.cjn~118.cmf~143.cmh~118.cmi~118.cpa~143.cpc_1~118.cpe~118.cs5~143.cs7_1~118.csa~118.cv2~143.cv8_1~118.cvb~118.cxx~143.cy5_1~118.cy7~118.d0y~143.d0z_5~118.d15~118.d3r~143.d3w_1~118.d3w~118.d6m~143.d6p_1~118.d6p~118.d9h~143.d9j_1~118.d9k~118.dcb~143.dcd~118.dce~118.df6~143.df9_1~118.dfe~118.dhz~143.di2_1~118.di4~118.dku~143.dkw~118.dkx~118.dnp~143.dnq~118.dns~118.dqi~143.dqj~118.dqk~118.dtd~143.dtf_1~118.dth~118.dw7~143.dw9~118.dwa~118.dz2~143.dz5_1~118.dz8~118.e1z_4~143.e26_1~118.e2c~118.e4u~143.e4z_1~118.e50~118.e80~143.e82~118.e86~118.eau~143.eb5_1~118.eb7~118.edn~143.edx_1~118.edy~118.egh~143.egq_1~118.egr~118.ejb~143.ejk~118.ejl~118.eme~143.emh~118.eml~118.ep8~143.epa_1~118.epc~118.es2~143.es4~118.es5~118.euw~143.eux~118.euy~118.exs~143.exu_1~118.exx~118.f0m~143.f0o_1~118.f0p~143.f46_1~118.f4k~118.f4n~118.f6u~143.f6z~118.f6z~118.f9p~143.f9r~118.f9s~118.fci~143.fck~118.fck~118.ffc~143.ffe~118.ffg~118.fi6~143.fi7~118.fi7~118.fl0~143.fl1~118.fl2~118.fnv~143.fnw~118.fnx~118.fqp~143.fqq~118.fqt~118.ftl~143.ftn_1~118.fto~118.fwe~143.fwg~118.fwh~118.fz9~143.fza~118.fzb~118.g23~143.g26_1~118.g28~118.g4y~143.g50~118.g52~118.g7t~143.g7u~118.g7v~118.gao~143.gaq_1~118.gau~118.gdi~143.gdj~118.gdk~118.ggd~143.ggf~118.ggh~118.gj9~143.gjf_1~118.gjj~118.gm4~143.gm8_1~118.gm9~118.goy~143.gp1_1~118.gp2~118.grs~143.gru~118.grv~118.gun~143.guo~118.gup~118.gxh~143.gxj_1~118.gxm~118.h0c~143.h0d~118.h0e~118.h36~143.h37_1~118.h39~118.h60~143.h62~118.h63~118.h8u~143.h8v~118.h8w~118.hbo~143.hbp~118.hbq~118.hej~143.hej~118.hel~118.hhc~143.hhd_1~118.hhf~118.hk6~143.hk7~118.hk9~118.hn2~143.hn4_1~118.hn8~118.hpv~143.hpw_1~118.hpx~118.hst~143.hsu_1~118.ht2~118.hvp~143.hvq_1~118.hvt~118.hyj~143.hyl~118.hym~118.i1g~143.i1h~118.i1k~118.i49~143.i4a_1~118.i4c~118.i76~143.i76_1~118.i7d~118.ia0~143.ia1_3~118.ia5~143.idj_1~118.idn~118.idt~143.igc_1~118.igd~118.igh~143.ij5_1~118.ij5~118.ijc~143.ilx_1~118.ily~118.im7~143.ioq_1~118.ior~118.ip0~143.irj_1~118.irk~118.irv~143.iuc_1~118.iud~118.iur~143.ix5_1~118.ix6~118.ixs~143.j02_1~118.j05~118.j0j~143.j2v_1~118.j2w~118.j3f~143.j5o_1~118.j5o~118.j6x~143.j8h_1~118.j8i~118.j9j~143.jbc_1~118.jbc~118.jcd~143.je8_1~118.je8~118.jf7~143.jh0_1~118.jh1~118.ji1~143.jjt_1~118.jju~118.jkw~143.jmm~118.jmm
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 44AF 0
56 B 157ms
157ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4uk&chm=1&ctx=2&qqid=CN2m5-HLuOgCFZkW4AodXq4J4w&met.3=143.12r_1~118.145~118.149~143.16e_1~118.16j~118.16k~143.19h_1~118.19q~118.19r~118.1c9~118.1cv~143.1cz_1~118.1dd~118.1de~143.1fu_1~118.1fw~118.1g8~143.1iq_1~118.1is~118.1j2~143.1lj_1~118.1ll~118.1lw~143.1od_1~118.1og~118.1os~143.1r6_1~118.1r7~118.1rm~143.1tz_1~118.1u0~118.1uh~143.1ws_1~118.1wt~118.1xc~143.1zl_1~118.1zl~118.206~143.22e_1~118.22e~118.232~143.256_1~118.257~118.25y~143.27z_1~118.280~118.28s~143.2as_1~118.2as~118.2bn~143.2dk_1~118.2dl~118.2ei~143.2gd_1~118.2ge~118.2he~143.2j6_1~118.2j7~118.2ke~143.2lz_1~118.2m0~118.2n8~143.2ot_1~118.2ot~118.2q4~143.2rm_1~118.2rn~118.2t0~143.2uk_1~118.2ul~118.2w1~143.2xd_1~118.2xe~118.2yv_1~143.306_1~118.307~118.31q~143.32z_1~118.330~118.34l~143.35s_1~118.35t~118.37g~143.38l_1~118.38m~118.3ad~143.3be_1~118.3bf~118.3d8~143.3e7_1~118.3e7~118.3g3~143.3gz_1~118.3h0~118.3iz~143.3jt_1~118.3jv~118.3lu~143.3mr_1~118.3mt~118.3oq~143.3pk_1~118.3pl~118.3rl~143.3sd_1~118.3se~118.3uo~143.3v7_1~118.3v9~118.3xg~143.3yc_1~118.3ye~143.45j_1~118.45o~118.46r~118.489~143.4cn_1~118.4dc~118.4dg~143.4fk_1~118.4fo~118.4g4~143.4id_1~118.4ie~118.4iy~143.4l6~118.4l6~118.4lu~143.4nz_1~118.4nz~118.4oq~143.4qs~118.4qs~118.4rk~143.4tl_1~118.4tn~118.4uf~143.4we_1~118.4wg~118.4xa~143.4z7_2~118.4z9~118.50u_3~143.522_k~118.52m~118.53m_1~143.55e_1~118.55e~118.56h~143.587_1~118.588~118.59b~143.5b0_1~118.5b1~118.5c7~143.5dt_1~118.5du~118.5f3~143.5gm_1~118.5gn~118.5hz~143.5jf_1~118.5jg~118.5kt~143.5m8_1~118.5m9~118.5no~143.5p3_1~118.5p4~118.5qj~143.5rv_1~118.5rw~118.5th~143.5ur_1~118.5ut~118.5wd~143.5xk_1~118.5xl~118.5zg~143.60d_1~118.60e~118.62c~143.636_1~118.637~118.65h~143.65z_1~118.660~118.688~143.68s_1~118.68t~118.6b4~143.6bq_1~118.6bs~118.6dy~143.6ei_1~118.6ej~118.6gt~143.6hb_1~118.6hc~118.6jn~143.6k4_1~118.6k5~118.6mj~143.6my_1~118.6my~118.6pe~143.6pr_1~118.6pr~118.6s8~143.6sk_1~118.6sl~118.6v3~143.6ve_1~118.6vf~118.6xw~143.6y7_1~118.6y7~118.70q~143.70z_1~118.710~118.73k~143.73s~118.73t~118.76f~143.76l~118.76l~118.799~143.79e~118.79h~118.7c3~143.7c7~118.7c7~118.7ey~143.7f2_1~118.7f5~118.7hs~143.7hw~118.7hw~118.7ko~143.7ky_4~118.7l5~118.7nk~143.7nv_1~118.7nw~118.7qf~143.7qp_1~118.7qp~118.7t9_3~143.7u8_1~118.7uk~118.7w6~143.7x1~118.7x1~118.7z3~143.7zu_1~118.7zv~118.81x~143.82n_1~118.82n~118.84t~143.85f_1~118.85g~118.87n~143.88a_1~118.88c~118.8ai~143.8b3_1~118.8b3~118.8db~143.8dw_1~118.8dw~118.8g5~143.8gp_1~118.8gp~118.8j0~143.8jh_1~118.8ji~118.8lv~143.8mj_1~118.8mm~118.8op~143.8pc_2~118.8pf~118.8rt~143.8s7_1~118.8s8~118.8un~143.8v0_1~118.8v1~118.8xh~143.8xt_1~118.8xu~118.90c~143.90n~118.90o~118.937~143.93g_1~118.93h~118.962~143.969_1~118.969~118.98y~143.992~118.992~118.9bt~143.9bw_1~118.9by~118.9ep~143.9es~118.9et~118.9hj~143.9hl~118.9hm~118.9kd~143.9ki_1~118.9kl~118.9n8~143.9nc~118.9nf~118.9q3~143.9q7_1~118.9q8~118.9sy~143.9t2_1~118.9t5~118.9vs~143.9vv~118.9vv~118.9yp~143.9yr~118.9z1~118.a1i~143.a1l_1~118.a1m~118.a4f~143.a4n~118.a4q~118.a7a~143.a7g_1~118.a7h~118.aa5~143.aa9~118.aa9~118.acz~143.ad3~118.ad5~118.aft~143.afw~118.afx~118.aip~143.ait_1~118.aix~118.alj~143.alp_1~118.als~118.aof~143.aok_1~118.aon~118.arb~143.are_1~118.ark~118.au5~143.au9_1~118.aua~118.ax0~143.ax4~118.ax5~118.azu~143.azz_1~118.b00~118.b2p~143.b2s~118.b2t~118.b5k~143.b5n~118.b5r~118.b8e~143.b8h~118.b8h~118.bb7~143.bbb_1~118.bbd~118.be1~143.be4~118.be4~118.bgv~143.bgx~118.bgy~118.bjo~143.bjr_1~118.bjs~118.bms_1~143.bne_3~118.bo1~118.bpn~143.bq9_1~118.bqa~143.bu4_1~118.bua~118.bud~118.bww~143.bx5_1~118.bxe~118.bzq~143.bzy_1~118.bzz~118.c2k~143.c50_1~118.c5m~118.c6z~143.c7s_1~118.c7t~118.c9o~143.cal_1~118.cam~118.cdd_1~143.cdg_1~118.cdj~118.cg6~143.cgb_1~118.cgc~118.cj3~143.cja_1~118.cjc~118.clz~143.cm2_1~118.cm3~118.cot~143.cow~118.coy~118.cro~143.crr_1~118.crt~118.cuj~143.cun_1~118.cup~118.cxg~143.cxo_1~118.cxq~118.d0b~143.d0k_1~118.d0m~118.d3c~143.d3j_1~118.d3o~118.d66~143.d6c_1~118.d6c~118.d90~143.d94_1~118.d95~118.dbv~143.dby_1~118.dc0~118.dep~143.des_1~118.deu~118.dhk~143.dhp_1~118.dht~118.dke~143.dki_1~118.dkk~118.dn8~143.dnc~118.dnc~118.dq3~143.dq6~118.dq6~118.dsx~143.dsz~118.dsz~118.dvs~143.dvu~118.dvw~118.dyl~143.dyo~118.dyp~118.e1g~143.e1l_1~118.e1n~118.e4e~143.e4l_1~118.e4r~118.e78~143.e7e_1~118.e7f~118.eae~143.eah~118.eal~118.ed6~143.edk_1~118.edq~118.eg1~143.egd_1~118.ege~118.eiv~143.ej6_1~118.ej7~118.elq~143.em0~118.em0~118.eos~143.eox~118.ep0~118.erm~143.err_1~118.ers~118.euh~143.euk~118.eul~118.exa~143.exc~118.exd~118.f06~143.f0a_1~118.f0e~118.f30~143.f33_1~118.f35~143.f6x_1~118.f6y~118.f74~118.f99~143.f9q~118.f9q~118.fc3~143.fcj~118.fcj~118.fex~143.ffc~118.ffc~118.fhr~143.fi5_1~118.fi5~118.fkk~143.fky~118.fky~118.fne~143.fnq~118.fnr~118.fq9~143.fqj~118.fqk~118.ft4~143.fte_1~118.fth~118.fvz~143.fw7~118.fw8~118.fyt~143.fz0_1~118.fz1~118.g1n~143.g1t_1~118.g1u~118.g4h~143.g4o_1~118.g4q~118.g7c~143.g7i_1~118.g7l~118.ga7~143.gac~118.gac~118.gd2~143.gd8_1~118.gdb~118.gfx~143.gg0~118.gg1~118.gir~143.giv~118.giy~118.gln~143.glx_1~118.gm1~118.goi~143.gor~118.gos~118.grd~143.grj~118.grk~118.gu7~143.guc~118.guc~118.gx1~143.gx5~118.gx6~118.gzw~143.h01_1~118.h04~118.h2q~143.h2v_1~118.h2x~118.h5k~143.h5q~118.h5s~118.h8f~143.h8j~118.h8k~118.hb8~143.hbc~118.hbc~118.he2~143.he6~118.he8~118.hgx~143.hh0~118.hh2~118.hjr~143.hju~118.hjx~118.hmk~143.hmo~118.hmq~118.hph~143.hpl~118.hpo~118.hs9~143.hsf~118.hsj~118.hv5~143.hvd~118.hvk~118.hy3~143.hy8_1~118.hyb~118.i0y~143.i12_1~118.i14~118.i3t~143.i40_1~118.i41~118.i6n~143.i6t~118.i6t~118.i9k~143.i9t_1~118.iaf~118.ice~143.ico_1~118.icq~143.ig6_1~118.ig8~118.igc~118.iiw~143.ij0~118.ij1~118.ilq~143.ilv~118.ilx~118.iol~143.ioq_1~118.ios~118.irf~143.irj~118.irl~118.iu9~143.iuf_1~118.iui~118.ix5~143.ixa_1~118.ixf~118.j05~143.j0i_3~118.j0w~118.j2x~143.j3d_1~118.j3e~118.j5u~143.j66~118.j66~143.j9a_1~118.j9b~118.j9h~118.jbx~143.jc4_1~118.jc5~118.jes~143.jex~118.jey~118.jhl~143.jhq~118.jhq~118.jkg~143.jkj~118.jkk~118.jna~143.jnf_1~118.jnh~118.jq3
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BA6C 0
56 B 157ms
157ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4us&chm=1&ctx=2&qqid=COKm5-HLuOgCFZkW4AodXq4J4w&met.3=143.10z_1~118.113~118.11j~118.13e~143.13v_1~118.13w~118.16m~143.16x_1~118.177~118.192~118.19p~143.1a1_1~118.1a9~118.1aa~143.1cz_1~118.1d3~118.1d3~118.1fw~143.1fw_1~118.1fz~118.1ir~143.1is_1~118.1iu~118.1ln~143.1ln_1~118.1lq~118.1og~143.1oh~118.1oh~118.1rb~143.1rb~118.1rc~118.1u7~143.1u7_1~118.1u9~118.1x0~143.1x0~118.1x2~118.1zy~143.1zy_1~118.202~118.22s~143.22s_1~118.22u~118.25m~143.25n_1~118.25o~118.28h~143.28i_1~118.28k~118.2bc~143.2bc~118.2be~118.2e8~143.2e8_1~118.2ea~143.2h6_1~118.2h8~118.2hb~118.2k3~143.2k3_1~118.2k5~118.2mz~143.2mz_1~118.2n5~118.2pv~143.2pv_1~118.2px~118.2sv~143.2sw_1~118.2sy~118.2vr~143.2vr_1~118.2vu_1~118.2yk~143.2yl_1~118.2ym~118.31g~143.31g_1~118.31i~118.34a~143.34b_1~118.34f~143.376~118.377~118.378~118.3a2~143.3a2~118.3a5~118.3cx~143.3cy_1~118.3d1~118.3fu~143.3fv_1~118.3fy~118.3io~143.3io_1~118.3iq~118.3lk~143.3lk_1~118.3lm~118.3of~143.3of_1~118.3oi~143.3rf_1~118.3ri~118.3rq~118.3ua~143.3ub_1~118.3uc~143.3zf_1~118.40m~118.42i~143.43f_2~118.449~118.454~143.4a1_1~118.4ac~118.4ac~118.4cy~143.4cy_1~118.4d1~118.4fr~143.4fs_2~118.4fv~118.4io~143.4io~118.4ip~118.4lj~143.4lj~118.4ll~118.4oe~143.4of~118.4oh~118.4ra~143.4ra_1~118.4rc~118.4u3~143.4u4~118.4u6~143.4xi_1~118.4xr~118.4y0~118.50h~143.50h_1~118.50k~118.53c~143.53c_1~118.53e~118.565~143.565_1~118.567~118.591~143.592_1~118.594~118.5bx~143.5bx_1~118.5c0~118.5et~143.5et_1~118.5ev~118.5hn~143.5ho_1~118.5hp~118.5ki~143.5ki_1~118.5kk~118.5ne~143.5ne_1~118.5nj~118.5qc~143.5qc_1~118.5qf~118.5t7~143.5t7_1~118.5t9~118.5wa~143.5wa_1~118.5wf~118.5z6~143.5z7_1~118.5z8~143.626_1~118.62c~118.62g~118.652~143.654_1~118.657~118.67y~143.67y~118.67z~118.6as~143.6at_1~118.6au~118.6dn~143.6do_1~118.6dr~118.6gh~143.6gj_1~118.6gl~118.6jd~143.6je~118.6jf~118.6m8~143.6m9~118.6mb~118.6p2~143.6p2~118.6p3~118.6rx~143.6rx~118.6s0~118.6uq~143.6ur~118.6ur~118.6xk~143.6xl~118.6xn~118.70f~143.70h~118.70j~118.739~143.73b~118.73b~118.763~143.765~118.767~118.78x~143.78y~118.78y~118.7bs~143.7bt_1~118.7bw~118.7em~143.7en~118.7eo~118.7hj~143.7ho_1~118.7hx~118.7ke~143.7kk_1~118.7km~118.7n9~143.7nf_1~118.7nh~118.7qo_8~143.7qx_1~118.7r6~118.7t3~143.7tp~118.7tq~118.7vy~143.7wj_1~118.7wk~118.7yr~143.7zc~118.7zd~118.81n~143.825~118.826~118.84g~143.84y~118.84y~118.87b~143.87q~118.87q~118.8a5~143.8aj~118.8aj~118.8d0~143.8db~118.8dc~118.8fu~143.8g4_1~118.8g5~118.8io~143.8ix_1~118.8iy~118.8lj~143.8lq~118.8lq~118.8oo~143.8or_1~118.8ov~118.8rh~143.8rk~118.8rk~118.8ub~143.8uc~118.8ud~118.8x6~143.8x7~118.8x7~118.901~143.902~118.904~118.92w~143.92w_1~118.92y~118.95s~143.95t~118.95u~118.98n~143.98o~118.98q~118.9bj~143.9bk~118.9bm~118.9ec~143.9ed~118.9ee~118.9h8~143.9h9_1~118.9hd~118.9k2~143.9k3_1~118.9k5~118.9mx~143.9my~118.9mz~118.9ps~143.9pt_1~118.9pw~118.9sm~143.9sm~118.9sn~143.9vh~118.9vj~118.9vl~118.9yc~143.9yc~118.9yd~118.a19~143.a1a~118.a1i~118.a44~143.a45_1~118.a47~118.a6z~143.a70~118.a71~118.a9t~143.a9u~118.a9v~118.acn~143.aco~118.acp~118.afj~143.afk_1~118.afo~118.aie~143.aif_1~118.aij~118.al9~143.alb_1~118.ald~118.ao4~143.ao5~118.ao7~118.aqz~143.ar0~118.ar3~118.atu~143.atu~118.atx~118.awo~143.awp_1~118.awr~118.azi~143.azj~118.azk~118.b2e~143.b2f~118.b2h~118.b57~143.b58~118.b5a~118.b81~143.b82~118.b84~118.bav~143.bav~118.baw~118.bdo~143.bdp~118.bdq~118.bgi~143.bgi~118.bgk~118.bju_1~143.bjy_2~118.bka_1~118.bmh~143.bms_1~118.bmt~143.bqs_1~118.br5~118.br5~118.btq~143.btr_1~118.bu0~118.bwk~143.bwl~118.bwl~118.bze~143.bze~118.bzg~143.c3m~118.c3t~118.c3u~118.c6i~143.c6i_1~118.c6l~143.c9s_1~118.c9y~118.ca8~143.ccm_1~118.ccm~118.cd0~143.cfe_1~118.cff~118.cfx~143.ci7_1~118.ci8~118.cit~143.cl0_1~118.cl1~118.cln~143.cnt_1~118.cnu~118.coi~143.cqm_1~118.cqn~118.crd~143.ctf_1~118.ctg~118.cua~143.cw8_1~118.cw9~118.cx5~143.cz1_1~118.cz2~118.d06~143.d1v_1~118.d1w~118.d30~143.d4v_1~118.d4x~118.d5u~143.d7o_1~118.d7p~118.d8p~143.dah_1~118.dai~118.dbj~143.dda_1~118.dda~118.dee~143.dg2~118.dg3~118.dh7~143.div_1~118.diw~118.dk2~143.dlo~118.dlo~118.dmx~143.dog_1~118.doh~118.dpq~143.dr9~118.dra~118.dsm~143.du2_1~118.du2~118.dvf~143.dwu_1~118.dwv~118.dyb~143.dzn_1~118.dzo~118.e1c~143.e2i_1~118.e2k~118.e42~143.e5b_1~118.e5c~118.e79~143.e84_1~118.e85~118.ea2~143.eax_1~118.eay~118.ecv~143.edt_1~118.edv~118.efp~143.egm_1~118.egn~118.eik~143.ejf_1~118.ejg~118.elm~143.em8_1~118.em9~118.eog~143.ep1~118.ep1~118.erb~143.eru_1~118.eru~118.eu4~143.eum_1~118.eun~118.ex0~143.exf_1~118.exf~118.ezu~143.f07~118.f08~118.f3s~143.f3s_1~118.f3x~118.f63~143.f6l~118.f6l~118.f8x~143.f9d~118.f9e~118.fbq~143.fc6~118.fc6~118.fek~143.fez_1~118.fez~118.fhe~143.fhr~118.fhs~118.fk8~143.fkk~118.fkk~118.fn3~143.fnd~118.fnd~118.fpx~143.fq8_1~118.fqb~118.fst~143.ft1_1~118.ft2~118.fvm~143.fvu~118.fvv~118.fyh~143.fyo_1~118.fyp~118.g1b~143.g1i_1~118.g1k~118.g46~143.g4c_1~118.g4e~118.g71~143.g75~118.g76~118.g9w~143.ga1_1~118.ga4~118.gcq~143.gcu~118.gcu~118.gfl~143.gfo~118.gfr~118.gii~143.gir_1~118.giu~118.glc~143.glk~118.gll~118.go7~143.god~118.god~118.gr0~143.gr6~118.gr6~118.gtv~143.gtz~118.gtz~118.gwq~143.gwu_1~118.gwx~118.gzk~143.gzp~118.gzs~118.h2e~143.h2j~118.h2l~118.h59~143.h5d~118.h5d~118.h82~143.h85~118.h86~118.haw~143.hb0~118.hb1~118.hdr~143.hdt~118.hdv~118.hgk~143.hgo_1~118.hgq~118.hje~143.hji~118.hjk~118.hmb~143.hme~118.hmh~118.hp3~143.hp9~118.hpc~118.hs1~143.hs6_3~118.hsd~118.hux~143.hv3_1~118.hv4~118.hxr~143.hxx_1~118.hxy~118.i0o~143.i0t~118.i0v~118.i3h~143.i3m~118.i3n~118.i6e~143.i6n_1~118.i78~118.i98~143.i9i_1~118.i9j~143.icq~118.icu~118.id2~143.ifj_1~118.ifj~118.ifq~143.iib_1~118.iic~118.iik~143.il4_1~118.il5~118.ilf~143.inx_1~118.iny~118.io8~143.iqq_1~118.iqr~118.ir3~143.itj_1~118.itj~118.itz~143.iwc_1~118.iwc~118.ix1~143.iz4_1~118.iz9~118.izr~143.j1x~118.j1y~118.j2o~143.j4q_1~118.j4r~118.j65~143.j7k_1~118.j7k~118.j8r~143.jae_1~118.jaf~118.jbl~143.jd7_1~118.jd8~118.jef~143.jg0~118.jg0~118.jh9~143.jis~118.jit~118.jk5~143.jll~118.jll~118.jmy~143.joe_1~118.joe~118.jpr~143.jr6_1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ED7E 0
56 B 156ms
156ms Other
image/gif 2607:f8b0:400a:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k88zp4t3&chm=1&ctx=2&qqid=CNqm5-HLuOgCFZkW4AodXq4J4w&met.3=118.13l~118.13q~143.13x_1~118.15j~118.15q~143.16q_1~118.16r~118.181~143.19j_1~118.19k~118.1b8~118.1dq~143.1dy_1~118.1ed~118.1ei~118.1ew~143.1gr_1~118.1gs~118.1hp~143.1jk_1~118.1jl~118.1kj~143.1md_1~118.1me~118.1nd~143.1p6_1~118.1p6~118.1q9~143.1ry_1~118.1rz~118.1t4~143.1ur_1~118.1us~118.1vy~143.1xk_1~118.1xm~118.1yt~143.20d_1~118.20e~118.21o~143.236_1~118.237~118.24j~143.25z_1~118.260~118.27f~143.28s_1~118.28t~118.2a9~143.2bl_1~118.2bm~118.2d4~143.2em_1~118.2eo~118.2g0~143.2hg_1~118.2hh~118.2iv~143.2k9_1~118.2kb~118.2lv~143.2n3_1~118.2n4~118.2op~143.2pw_1~118.2px~118.2rl~143.2ss_1~118.2su~118.2uh~143.2vm_1~118.2vo~118.2xh~143.2yi_1~118.2yj_1~118.30d~143.31b_1~118.31c~118.337~143.344_1~118.345~118.363~143.36z_1~118.370~118.38x~143.39t_1~118.39u~118.3bu~143.3cn~118.3cn~118.3ep~143.3fg_1~118.3fh~118.3hk~143.3ia_1~118.3ib~118.3kg~143.3l4_1~118.3l5~118.3nb~143.3nx~118.3ny~118.3q7~143.3qr_1~118.3qs~118.3t2~143.3tn_1~118.3to~118.3w4~143.3wl_1~118.3wm~118.3yx~143.3zt_1~118.3zw~143.470_1~118.475~118.487~118.49q~143.4e1_1~118.4et~118.4ex~143.4h5~118.4h6~118.4hl~143.4jy~118.4jy~118.4kf~143.4mq~118.4mr~118.4na_1~143.4pj~118.4pk~118.4q7~143.4sc_1~118.4sf~118.4t1~143.4v9_1~118.4va~118.4vx~143.4y2_1~118.4y3~118.4yr~143.511_1~118.513~118.52b~143.547_1~118.54d~118.553~143.570~118.570~118.57y~143.59u_1~118.59v~118.5at~143.5co~118.5co~118.5do~143.5fh_1~118.5fi~118.5gk~143.5ia_1~118.5ib~118.5jg~143.5l3_1~118.5l4~118.5mb~143.5nx_1~118.5ny~118.5p5~143.5qr_1~118.5qs~118.5s1~143.5tk_1~118.5tl~118.5uz~143.5we_5~118.5wj~118.5xu~143.5zb~118.5zb~118.60x~143.623_1~118.624~118.63t~143.64x_1~118.64y~118.66v~143.67q_1~118.67r~118.69p~143.6am_1~118.6an~118.6cl~143.6dh_1~118.6dm~118.6ff~143.6gc_1~118.6gc~118.6ia~143.6j5_1~118.6j6~118.6l4~143.6ly_1~118.6lz~118.6o0~143.6or~118.6or~118.6qv~143.6rj~118.6rk~118.6tp~143.6uc~118.6uc~118.6wk~143.6x8_1~118.6xb~118.6ze~143.701_1~118.702~118.727~143.72u_1~118.72v~118.751~143.75n~118.75o~118.77w~143.78g~118.78g~118.7ar~143.7ba~118.7bb~118.7dl~143.7e3~118.7e3~118.7gg~143.7gw_1~118.7gw~118.7ja~143.7jp_1~118.7jp~118.7m6~143.7mn_4~118.7mt~118.7p1~143.7pk_1~118.7pl~118.7rw~143.7se~118.7sg_4~118.7ur~143.7vv_1~118.7w3~118.7xn~143.7yn~118.7yo~118.80k~143.81g_1~118.81h~118.83e~143.849_1~118.84a~118.86a~143.872_1~118.873~118.894~143.89y~118.8a0~118.8bz~143.8cr~118.8cr~118.8et~143.8fj~118.8fk~118.8hn~143.8ic_1~118.8id~118.8kh~143.8l5~118.8l5~118.8nc~143.8o7~118.8oa~118.8q6~143.8r7_2~118.8rh~118.8t9~143.8u1_1~118.8u1~118.8w5~143.8wt~118.8wu~118.8yz~143.8zm~118.8zm~118.91u~143.92e~118.92f~118.94p~143.957~118.957~118.97j~143.97z~118.980~118.9af~143.9as_1~118.9as~118.9da~143.9dk~118.9dl~118.9g6~143.9gd~118.9gd~118.9j0~143.9j5~118.9j6~118.9lv~143.9m2~118.9m5~118.9op~143.9oy~118.9oy~118.9rk~143.9rr_1~118.9rs~118.9uf~143.9un~118.9uo~118.9x9~143.9xf~118.9xg~118.a07~143.a0i~118.a0p~118.a2z~143.a3b~118.a3b~118.a5w~143.a67~118.a68~118.a8r~143.a91~118.a93~118.abm~143.abt~118.abu~118.aeh~143.aes_1~118.aeu~118.ahb~143.ahk_1~118.ahl~118.ak6~143.akf_1~118.akh_1~118.an1~143.ana_1~118.anc~118.apw~143.aq6~118.aq8~118.ass~143.at3_1~118.at6~118.avn~143.avw~118.avx~118.ayh~143.ayp~118.ayq~118.b1b~143.b1j~118.b1k~118.b46~143.b4d~118.b4d~118.b71~143.b78~118.b7a~118.b9v~143.ba1~118.ba1~118.bcp~143.bcw~118.bcy~118.bfi~143.bfp~118.bfp~118.bic~143.bii_1~118.bij~118.bl6~143.blc~118.bld~118.bo7_1~143.bp9_2~118.bpn~118.br4~143.bs4_1~118.bs4~143.bvn_1~118.bvq~118.bvv~118.byd~143.byo_1~118.byw~118.c17~143.c1h_1~118.c1i~118.c41~143.c6i~118.c79~118.c8g~143.c9b_1~118.c9c~118.cb5~143.cc4_1~118.cc5~118.ceu~143.cez_1~118.cf1~118.chn~143.cht_1~118.chu~118.ckk~143.cks_1~118.cku~118.cng~143.cnl_1~118.cnl~118.cqb~143.cqf~118.cqi~118.ct5~143.cta~118.ctb~118.cw0~143.cw5_1~118.cw7~118.cyx~143.cz7_1~118.cz8~118.d1s~143.d23_1~118.d24_2~118.d4t~143.d51_1~118.d58~118.d7n~143.d7u_1~118.d7v~118.dai~143.dan~118.dan~118.ddc~143.ddh~118.ddi~118.dg7~143.dgb~118.dgc~118.dj2~143.dj9_1~118.djc~118.dlv~143.dm2_1~118.dm3_1~118.doq~143.dov_1~118.dow~118.drk~143.dro~118.drp~118.due~143.duh~118.dui~118.dx9~143.dxd~118.dxe~118.e03~143.e06~118.e07~118.e2y~143.e33~118.e36~118.e5v~143.e63_1~118.e69~118.e8q~143.e8x~118.e8z~118.ebo~143.ec0~118.ec3~118.een~143.ef3~118.ef8~118.ehj~143.ehx_1~118.ehy~118.ekd~143.ekq_1~118.ekr~118.en7~143.enj~118.enk~118.eq9~143.eqg~118.eql~118.et3~143.eta~118.eta~118.evy~143.ew3~118.ew4~118.eys~143.eyv~118.eyw~118.f1o~143.f1u~118.f1w~118.f4h~143.f4n~118.f4o~143.f7l_1~118.f83~118.f8e~143.fae~118.fae~118.faq~143.fd6~118.fd7~118.fdl~143.ffz~118.ffz~118.fge~143.fis~118.fis~118.fj8~143.flk~118.fll~118.fm2~143.fod~118.fod~118.fov~143.fr6~118.fr6~118.frr~143.fty~118.ftz~118.ful~143.fwr~118.fwr~118.fxg~143.fzk~118.fzk~118.g0a~143.g2c_1~118.g2d~118.g34~143.g55~118.g56~118.g5z~143.g80~118.g81~118.g8u~143.gat_1~118.gau~118.gbp~143.gdm~118.gdm~118.gek~143.ggf~118.ggf~118.ghe~143.gj8_1~118.gj8~118.gk9~143.gm1_1~118.gm1~118.gn4~143.got_1~118.gou~118.gpz~143.grm~118.grm~118.gsu~143.guf~118.guf~118.gvo~143.gx7~118.gx7~118.gyi~143.h00~118.h00~118.h1d~143.h2t_1~118.h2t~118.h47~143.h5l~118.h5m~118.h72~143.h8e~118.h8e~118.h9w~143.hb6~118.hb7~118.hcq~143.he0~118.he1~118.hfk~143.hgt_1~118.hgt~118.hie~143.hjl_1~118.hjm~118.hl8~143.hme~118.hme~118.ho2~143.hp7~118.hp7~118.hqy~143.hrz_1~118.hs0~118.htr~143.hus_1~118.hut~118.hwn~143.hxl_2~118.hxn~118.hzl~143.i0f_1~118.i0f~118.i2f~143.i37_1~118.i38~118.i5b~143.i60~118.i60~118.i85~143.i8t~118.i8t~118.ib1~143.ibz~118.ic0~118.idw~143.ies~118.ies~118.ihm~143.iht~118.ihu~118.ikd~143.ikm_1~118.ikm~118.in8~143.ing_1~118.inh~118.iq2~143.iqa_1~118.iqc~118.isw~143.it4~118.it5~118.ivq~143.iw0~118.iw2~118.iym~143.iyw~118.iyz~118.j1k~143.j2d_1~118.j2g~118.j4f~143.j56_1~118.j57~118.j7b~143.j7z_1~118.j80~118.jaq~143.jaz~118.jaz~118.jde~143.jdu_1~118.jdv~118.jg9~143.jgn~118.jgn~118.jj3~143.jjf~118.jjg~118.jlx~143.jm8~118.jm8~118.jor~143.jp0~118.jp0~118.jrl~143.jru~118.jrv~118.juf~143.jun~118.jun~118.jx9
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:804::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin: https://www.zdnet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 16:47:33 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 108ms
108ms Image
image/gif 18.209.91.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&u=DzAnuSprXi_eX7Ex&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.5&x=0&m=0&y=9189&o=1585&w=1200&j=45&R=0&W=0&I=1&E=5&e=0&r=&b=2701&t=CkRU2NDPuFs8QJUS7D85g-P2LDG5&V=118&tz=-60&_acct=anon&sn=3&sv=BszTyhC8tOydBRNMXoDjgK3SBkqHfO&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.91.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-91-145.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
pragma: no-cache
date: Thu, 26 Mar 2020 16:47:34 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 43
content-type: image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sofia.trustx.org
URL: https://sofia.trustx.org/hb?pt=net&auids=8432%2C8435%2C8437%2C8440%2C8441&sizes=728x90%2C970x250%2C970x66%2C300x250%2C300x600%2C300x1050&r=18e58bcc6d8159&wrapperType=Prebid_js&wrapperVersion=3.1.1&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&wtimeout=1000

Domain: apex.go.sonobi.com
URL: https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22%2F8264%2Fuk-zdnet%2Fleader-plus-top1%7C8ff661d0c721a1%22%3A%22728x90%2C970x250%2C970x66%22%2C%22%2F8264%2Fuk-zdnet%2Fmpu-plus-top1%7C9937c13ff8d55e%22%3A%22300x250%2C300x600%2C300x1050%22%2C%22%2F8264%2Fuk-zdnet%2Fmpu-middle1%7C1086452bd4be261%22%3A%22300x250%22%2C%22%2F8264%2Fuk-zdnet%2Fmpu-bottom1%7C11db924b9d56f21%22%3A%22300x250%22%2C%22%2F8264%2Fuk-zdnet%2Fleader-plus-bottom1%7C1239c1c8c82d0cb%22%3A%22728x90%2C970x250%2C970x66%22%7D&ref=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&s=a001b6ed-c7a2-413d-bf03-055dc35dffa5&pv=cb40aba1-1122-4abd-8c0b-a6959e455ba3&vp=desktop&lib_name=prebid&lib_v=3.1.1&us=5&ius=1&

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110776/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=55f54078f7f9756;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110771/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5684608061838a3;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110775/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5752136646674cc;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110769/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58de590010551a3;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110778/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=598458fa1025b4a;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110784/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60fd54174eab80d;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110785/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61159c70d921427;misc=1585241225712;

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9928.1/5110780/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=626a7681057d25e;misc=1585241225712;

Domain: cbsi-d.openx.net
URL: https://cbsi-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=74e22710-050a-47f5-b74b-0faeb6feb277%2C590af121-a81f-4619-8258-7724eb4b2959%2C2ab977c3-917f-4a29-a402-776de7ff3fe9%2Cab14d4f0-1d12-4653-a3f0-def2266106c6%2Cd5166c0c-990d-4d17-9980-e4f11f8d0d2a&nocache=1585241225717&aus=728x90%2C970x250%2C970x66%7C300x250%2C300x600%2C300x1050%7C300x250%7C300x250%7C728x90%2C970x250%2C970x66&divIds=leader-plus-top%2Cmpu-plus-top%2Cmpu-middle%2Cmpu-bottom%2Cleader-plus-bottom&auid=540801584%2C540801587%2C540801590%2C540801593%2C540801592&

Domain: as-sec.casalemedia.com
URL: https://as-sec.casalemedia.com/cygnus?s=390494&v=7.2&r=%7B%22id%22%3A%22461bf6e7b6ef14f%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2247060cae9278baa%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390494%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2248897bb32903e9e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390495%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22492f3a8d409baec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390500%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225046a38fc1c5c5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390501%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2251c69c255e0a26%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390504%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22527e06f3fc72329%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390507%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2253cf5de2ef8ed03%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390508%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225441e167e1745cd%22%2C%22ext%22%3A%7B%22siteID%22%3A%22390509%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&

Verdicts & Comments Add Verdict or Comment

147 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.zdnet.com/	1970-01-19 08:30:46	Name: RT Value: "z=1&dm=zdnet.com&si=d87471ec-af1d-4890-ac32-58e6c5039e47&ss=k88zoz1a&sl=1&tt=8r7&bcn=%2F%2F364bf6cc.akstat.io%2F&ld=8rc"
www.zdnet.com/	1969-12-31 23:59:59	Name: viewGuid Value: 7a61fa7a-4ecb-4aee-af48-67012916ed59
.zdnet.com/	1970-01-20 01:51:53	Name: __gads Value: ID=50764157a2a77d29:T=1585241227:S=ALNI_MZBmbbsQtVANxLR3qtY28GEzBYNig

51 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 298) Message: Found registered service worker: [object ServiceWorkerRegistration]
console-api	info	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 283) Message: Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: _injectQueryStringGCP functional
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_chartbeat performance
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_tealium functional
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 30) Message: Loading iframes
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); functional is allowed for _injectQueryStringGCP
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); performance is allowed for script_chartbeat
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); functional is allowed for script_tealium
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9) Message: adRegion: uk
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 77) Message: ---- [GLOBAL]: Ready
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 77) Message: ---- [GROUP LIST]: 1,0,0,0,0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 97) Message: zdnet
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 202) Message: New DW cookie set, exec sitecat
console-api	log	(Line 71) Message: blank creative loaded: 138239360957 (7 x 7, pos=nav, slot=nav-ad)
console-api	log	(Line 71) Message: blank creative loaded: 138239321475 (300 x 250, pos=top, slot=mpu-plus-top)
console-api	log	(Line 71) Message: blank creative loaded: 138248164873 (300 x 250, pos=middle, slot=mpu-middle)
console-api	log	(Line 71) Message: blank creative loaded: 138239368367 (641 x 321, pos=top, slot=inpage-video-top)
console-api	log	(Line 71) Message: blank creative loaded: 138239344157 (11 x 11, pos=top, slot=sharethrough-top)
console-api	log	(Line 71) Message: blank creative loaded: 138239321460 (300 x 250, pos=bottom, slot=mpu-bottom)
console-api	log	(Line 71) Message: blank creative loaded: 138286514475 (728 x 90, pos=bottom, slot=leader-plus-bottom)
console-api	info	URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003101714470 https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	(Line 71) Message: blank creative loaded: 138239468731 (372 x 142, pos=, slot=dynamic_showcase__0)
console-api	log	(Line 71) Message: blank creative loaded: 138239479696 (372 x 142, pos=, slot=dynamic_showcase__1)
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_urban_airship targeting
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 77) Message: ---- [GROUP LIST]: 1,0,0,0,0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 211) Message: ---- [DELAYED TAGS] All tags to fire: 1775,277,1772,1796,1810
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 78) Message: ---- [TAG CHECK] Tag ID: 1775 Group: 2 Result: 0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 78) Message: ---- [TAG CHECK] Tag ID: 277 Group: 4 Result: 0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 78) Message: ---- [TAG CHECK] Tag ID: 1772 Group: 2 Result: 0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 78) Message: ---- [TAG CHECK] Tag ID: 1796 Group: 4 Result: 0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 78) Message: ---- [TAG CHECK] Tag ID: 1810 Group: 4 Result: 0
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 211) Message: ---- [DELAYED TAGS] Must tags to fire:
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_taboola targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_async_load targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_taboola targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_async_load targeting
console-api	log	URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

364bf6cc.akstat.io
6852bd0c.akstat.io
adserver-us.adtech.advertising.com
adservice.google.co.uk
adservice.google.com
adservice.google.de
apex.go.sonobi.com
api.rlcdn.com
api.viglink.com
as-sec.casalemedia.com
at.cbsi.com
c.amazon-adsystem.com
c.go-mpulse.net
cbsi-d.openx.net
cdn.ampproject.org
cdn.cookielaw.org
cdn.viglink.com
csi.gstatic.com
dw.cbsi.com
geo.moatads.com
geolocation.onetrust.com
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
ib.adnxs.com
idx.liadm.com
iicbsi-a.akamaihd.net
js-sec.indexww.com
match.adsrvr.org
mid.rkdms.com
pagead2.googlesyndication.com
ping.chartbeat.net
production-cmp.isgprivacy.cbsi.com
rev.cbsi.com
securepubads.g.doubleclick.net
sofia.trustx.org
static.chartbeat.com
tags.tiqcdn.com
tpc.googlesyndication.com
urs.zdnet.com
vidtech.cbsinteractive.com
www.google.com
www.googletagservices.com
www.zdnet.com
z.moatads.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
adserver-us.adtech.advertising.com
apex.go.sonobi.com
as-sec.casalemedia.com
cbsi-d.openx.net
sofia.trustx.org
104.108.48.175
13.226.146.86
13.226.155.78
151.101.65.188
152.195.132.202
152.199.23.241
172.217.22.2
18.209.91.145
185.33.223.221
185.64.189.112
2600:9000:20eb:9800:18:1fcd:349:ca21
2606:4700:10::6814:b944
2606:4700::6810:a00d
2607:f8b0:400a:804::2003
2a00:1450:4001:808::2002
2a00:1450:4001:809::2002
2a00:1450:4001:809::2004
2a00:1450:4001:816::2002
2a00:1450:4001:817::2002
2a00:1450:4001:81b::2001
2a01:4a0:1338:28::c38a:ff11
2a02:26f0:6c00:181::11a6
2a04:4e42:1b::444
2a04:4e42:3::444
2a04:4e42:3::645
34.250.145.255
35.190.38.167
35.244.174.68
52.31.92.58
52.6.27.178
63.35.59.66
64.30.230.22
95.101.185.246
95.101.185.51
015e3eec7e95e21495ba3d0143d078f76e76f79d2d81f9e5d036e357459153e4
0290a012deb1b25451f5211d8cb8b40d8fa6f3942d23ecc12d96670e4c0ed7a5
03bcc1f2b1cd14113d9289d50792bce03d9acf51e3d9dfbe4e7f3ff9ae460cc8
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1
07ee3304cd671471764757b5f8bd8275bfb74456f134e7e8ce97ce18c8061318
0c44558c7e5c9da9acc834af8d934663e2db4b08a0b16809014a5ffc22197373
0e75b9fd0d9762b4a07eeebda8fcb58a10638984e133c876bd56facd18dea6fe
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
123d4b411f97e36f72e2f44be0b18944489e908ff159f59ab8aba984c69517fe
15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
22c5d9b429274e16a5f4f847e869cb61173a02b65c0ea748916e38dded6534c5
28114fc6663ec98b8f807e459e85a0b5b53399bb41e3110c896e4493c58d2c78
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2fe57900b9e85fed1f030f1708fe32a0b13d84850fb3b9398fc4174e146d4d08
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
328d295ac80c1bb34918bfede9952dd43910f71f3feb24e01d852db9a1dc467b
328fed03bc54229786055a93d3ec6abc6f7becf99849338cbb881b02c372514b
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7
3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349
40f39fd13c347ba41bb24d1bf622d4ab73bdc913359f3ca92ebb8f35f7fac77e
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3
462affeccc8485529f34f0328e9ce8a661b824def972da6dcaaa42d4a2892dde
4b4491c17dcd87963bc4a75a5b330aa0030d747a1239a8be9c6d3f13db8efce7
504c11ffc9c4a8d0fa18d850011e5332cfdff9785e9db66e2650a26cde01fba1
55620583eecd8f9a36a45072edeef72f395acdb8da34d22d9b1f8d599a43c25c
56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045
59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a
5dc9e7d2f16aeba5fbcb6b7155784f399056af88eb6e5fbb1ec79632bcc7e352
5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
70696f64d4166c01fc48556c521fe0048af71777b530f7be0f9734f27e0f3545
70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f
7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b
72c66bfd58f3fc5668b71e058dee00a5cddcb7563b76dcfac799f9cb28ddfe46
744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
785df7dc67144409c22bfb395cf7b1b56e623f11897782eed6eb44f1283a08ec
79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef
7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8
7ce2527966fa13427ad0fe52da9c10bbeaf9b3962999d75337b720977d2ee38d
7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b
824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92
831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba
837593028a367c7230b6031ca957137803fc1538687f56046c4b398b17dbd1cc
859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0
8fd89c4e7593e7e15a1ecdf7141192ba9751023d1fbfa77ba998df510306b4b5
91032730f8c25c27f6be4ef1ac9623d1de5db9ed3fcb5edb18ad65332cfea607
95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
9aee6b1bcdf617d8e39bb1f2b624c68ea33deb9d48e0364aeaded836d3d00293
a08c0a09a279b490a7df8c65edcf19348652f372d72d1fb39e078dfd340284a3
a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8
a5f3e41174dfbab395d1b802917ff07caf8d4504b1f63542b925b101f7ccc740
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
a7b65febc438aa5d36606447ccb170f9e78cc712343964f0820b8e3bc235c217
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
aeb3d3e48f39ea28fe85ff4ea9cbc7f668e49b18ceae8fce8e19495ffdbb2e9e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
c3eccb4080509e4a6f99d174b4899b425229f6d7f256d4f0c57f1e269b1bb8aa
c56d96daf11894dd062360bacacb0b9107b15cca513e885a197ee02968f42747
c93da10a0b37f717f799eb43bbed14f84d8cc6aeafcdbf27ca26621da0effae3
c95bc774b2ae8b3d433382ce08d5ef2e7b0df69f848ab965a1fc4e141ef6b457
cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016
dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d
dfdb21cf6583b14fae51ee166f863a403e5d7da342c3f219a882ebcb7686454e
e157ca3b91a2c8064ff20afafe5b4ea29405f92c79b9fe3acadf146ea785e5d1
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55
f1db58066d3bbb23a4a0b244a9778ab6bb2ac1e2d2a42eab6861c6a51dfc919c
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0
f5995963373c55d31dadf9b25910e0f88b7b9f11d2e1ac2032a3c5391a5c500f
f82e8053fbcd78685d9e26caebeebc38ee73eb9afa4bb36765c50ce6614eebf3
f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94
fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5
ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

www.zdnet.com Open in urlscan Pro 2a04:4e42:3::444 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

210 Requests

94 %HTTPS

44 %IPv6

35 Domains

48 Subdomains

34 IPs

6 Countries

3472 kBTransfer

10578 kBSize

3 Cookies

53 Outgoing links

Redirected requests

210 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.zdnet.com Open in urlscan Pro
2a04:4e42:3::444 Public Scan

Screenshot
Live screenshot

Full Image

210
Requests

94 %
HTTPS

44 %
IPv6

35
Domains

48
Subdomains

34
IPs

6
Countries

3472 kB
Transfer

10578 kB
Size

3
Cookies

210 HTTP transactions
9 data transactions