thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/doTlgCbdJ1
Effective URL:
https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=t...
Submission: On November 25 via api (November 25th 2020, 5:06:11 pm UTC) from US

Summary HTTP 60 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 21 IPs in 5 countries across 16 domains to perform 60 HTTP transactions. The main IP is 2606:4700:20::681a:61, located in United States and belongs to CLOUDFLARENET, US. The main domain is thehackernews.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 1st 2020. Valid for: a year.

This is the only time thehackernews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
16	2606:4700:20:... 2606:4700:20::681a:61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a823	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
2	205.234.175.175 205.234.175.175	23352 (SERVERCEN...) (SERVERCENTRAL)
11	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
4 5	216.58.210.6 216.58.210.6	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81a::2006	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2600:9000:20e... 2600:9000:20eb:3400:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
2 4	54.170.224.115 54.170.224.115	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81e::2002	15169 (GOOGLE) (GOOGLE)
2	23.97.225.52 23.97.225.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	172.217.18.162 172.217.18.162	15169 (GOOGLE) (GOOGLE)
2	52.84.134.201 52.84.134.201	16509 (AMAZON-02) (AMAZON-02)
2	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
60	21

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:4700:20::681a:61 (United States)

ASN13335 (CLOUDFLARENET, US)

thehackernews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 205.234.175.175 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: vip1.G-anycast1.cachefly.net

cdn.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 216.58.210.6 (Mountain View, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s07-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20eb:3400:19:fc2c:a140:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.170.224.115 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-170-224-115.eu-west-1.compute.amazonaws.com

att.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.97.225.52 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

e3.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.134.201 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-134-201.ams50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	thehackernews.com thehackernews.com	478 KB
13	doubleclick.net 4 redirects ad.doubleclick.net googleads.g.doubleclick.net securepubads.g.doubleclick.net googleads4.g.doubleclick.net stats.g.doubleclick.net	134 KB
11	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	162 KB
4	demdex.net 2 redirects att.demdex.net	3 KB
4	adpushup.com cdn.adpushup.com e3.adpushup.com	276 KB
4	googletagservices.com www.googletagservices.com	75 KB
2	google.com adservice.google.com www.google.com	276 B
2	google.de adservice.google.de www.google.de	276 B
2	amazon-adsystem.com c.amazon-adsystem.com	33 KB
2	agkn.com 2 redirects d.agkn.com	1 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	2mdn.net s0.2mdn.net	39 KB
2	cloudflare.com ajax.cloudflare.com cdnjs.cloudflare.com	32 KB
1	googleadservices.com partner.googleadservices.com	443 B
1	bit.ly 1 redirects bit.ly	229 B
1	t.co t.co	358 B
60	16

	Domain	Requested by
16	thehackernews.com	t.co thehackernews.com
6	pagead2.googlesyndication.com	ajax.cloudflare.com pagead2.googlesyndication.com www.googletagservices.com
5	ad.doubleclick.net	4 redirects ajax.cloudflare.com
4	att.demdex.net	2 redirects
4	tpc.googlesyndication.com	t.co tpc.googlesyndication.com pagead2.googlesyndication.com
4	www.googletagservices.com	ajax.cloudflare.com s0.2mdn.net pagead2.googlesyndication.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	googleads4.g.doubleclick.net	t.co
2	c.amazon-adsystem.com	cdn.adpushup.com c.amazon-adsystem.com
2	securepubads.g.doubleclick.net	cdn.adpushup.com securepubads.g.doubleclick.net
2	e3.adpushup.com	cdn.adpushup.com
2	d.agkn.com	2 redirects
2	www.google-analytics.com	t.co www.google-analytics.com
2	s0.2mdn.net	t.co s0.2mdn.net
2	cdn.adpushup.com	t.co cdn.adpushup.com
1	ade.googlesyndication.com
1	www.google.de
1	www.google.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdnjs.cloudflare.com	t.co
1	ajax.cloudflare.com	thehackernews.com
1	bit.ly	1 redirects
1	t.co
60	26

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feeds.feedburner.com
deals.thehackernews.com
thehackernews.tradepub.com
www.instagram.com
t.me
any.run
app.any.run
www.reddit.com
news.ycombinator.com
api.whatsapp.com
telegram.me
ad.doubleclick.net
go.thn.li

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
thehackernews.com Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.adpushup.com GlobalSign RSA OV SSL CA 2018	`2020-09-03` - `2021-10-05`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
Frame ID: F7D3FB99FC9C740690756B6ADE6BDC0F
Requests: 63 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/zrt_lookup.html
Frame ID: F43C39730456D9C988291FFD6C892FA8
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9AC6D93F6F82C7D877F678DC52267145
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/8532760/1604331588775/728x90/Gartner-Oct2020-728x90.html
Frame ID: FD6DBE0A22B94AB7F183476319A5FAE0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&adk=1812271804&adf=3025194257&lmt=1606288458&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954621&bpp=14&bdt=621&idt=216&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6016176465343&frm=20&pv=2&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=9127373482&dssz=39&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=251
Frame ID: 84AC537E3CF32EC96FB553308087760B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&h=600&slotname=3616315140&adk=1702816697&adf=3546401298&pi=t.ma~as.3616315140&w=300&fwrn=4&fwrnh=100&lmt=1606288458&rafmt=1&psa=0&format=300x600&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954635&bpp=4&bdt=635&idt=288&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6016176465343&frm=20&pv=1&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=146566326954&dssz=40&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1031&ady=701&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=zIqvgA6fFO&p=https%3A//thehackernews.com&dtd=299
Frame ID: 92080D51E56200EA770974DA8853DC8D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: DD1B64B071035B88975377CBF826DAEA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/doTlgCbdJ1 Page URL
https://bit.ly/2J4lxHW HTTP 301
https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium... Page URL

Page Statistics

60
Requests

100 %
HTTPS

59 %
IPv6

16
Domains

26
Subdomains

21
IPs

5
Countries

1313 kB
Transfer

2788 kB
Size

1
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/thehackernews
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/thehackersnews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/thehackernews?sub_confirmation=1
Title: 

Search URL Search Domain Scan URL

URL: https://feeds.feedburner.com/TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/
Title:  Offers

Search URL Search Domain Scan URL

URL: https://thehackernews.tradepub.com/
Title: Free eBooks

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/free
Title: Freebies

Search URL Search Domain Scan URL

URL: https://www.instagram.com/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://t.me/joinchat/AAAAADwuDObFWF60CiR-HQ
Title:  Telegram Channel

Search URL Search Domain Scan URL

URL: https://any.run/malware-trends/emotet
Title: Malware trends tracker

Search URL Search Domain Scan URL

URL: https://any.run/
Title: ANY.RUN service

Search URL Search Domain Scan URL

URL: https://app.any.run/submissions
Title: public submissions

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/596c9ec6-e10e-4871-9629-bbb02b48ec6d
Title: investigate one of the samples

Search URL Search Domain Scan URL

URL: https://app.any.run/
Title: ANY.RUN

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html&text=Evolution%20of%20Emotet%3A%20From%20Banking%20Trojan%20to%20Malware%20Distributor&via=TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html
Title: 

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html&t=Evolution%20of%20Emotet%3A%20From%20Banking%20Trojan%20to%20Malware%20Distributor
Title: Share on Hacker News

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Evolution%20of%20Emotet%3A%20From%20Banking%20Trojan%20to%20Malware%20Distributor%20%E2%80%94%20https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html
Title: Share on WhatsApp

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html&text=Evolution%20of%20Emotet%3A%20From%20Banking%20Trojan%20to%20Malware%20Distributor
Title: Share on Telegram

Search URL Search Domain Scan URL

URL: https://ad.doubleclick.net/ddm/clk/463791546;269244864;z

Search URL Search Domain Scan URL

URL: https://ad.doubleclick.net/ddm/jump/N424004.3381407THEHACKERNEWS/B23636320.269244864;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055

Search URL Search Domain Scan URL

URL: https://go.thn.li/AC

Search URL Search Domain Scan URL

URL: https://ad.doubleclick.net/ddm/clk/463791531;269244987;z

Search URL Search Domain Scan URL

URL: https://ad.doubleclick.net/ddm/jump/N424004.3381407THEHACKERNEWS/B23636320.269244987;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055

Search URL Search Domain Scan URL

URL: https://go.thn.li/AB
Title: Secure Code Bootcamp - Learn Secure Coding on the GoSecure Code Bootcamp is a free, fun mobile app for early-career coders.

Search URL Search Domain Scan URL

URL: https://go.thn.li/Z
Title: Free eBook - Infrastructure as Code Learn more about the infamous 8: Infrastructure as Code vulnerabilities and how to find and fix them.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-2019-ethical-hacker-masterclass-bundle
Title: <img alt='Learn Ethical Hacking Online' class='deal-link' src='https://thehackernews.com/images/-6bFLF28Wvxc/XHaUg588fBI/AAAAAAAAAGU/USPKfrcXaLgzaOBfKGb92v-0T12CIaK9wCLcBGAs/s260-e100/learn-hacking-training.jpg'/> Ethical Hacking - Practical Training 10 courses + 1,236 lessons on latest techniques, forensics, malware analysis, network security and programming.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/lifetime-access-to-stackskills-unlimited
Title: <img alt='Unlimited Secure VPN Service' class='deal-link' src='https://thehackernews.com/images/-NnUk1eJVmVk/XHggwOYT51I/AAAAAAAAzbg/_5sUNHfsdiYDo-si4rya7tVT4pSZI0qSACLcBGAs/s260-e100/unlimited-vpn.jpg'/> 1000+ Premium Online Courses With course certification, Q/A webinars and lifetime access.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-cybersecurity-expert-certification-training-bundle
Title: <img alt='Best Hacking Books' class='deal-link' src='https://thehackernews.com/images/-4fAuruXOrkE/XDW4dE5zVMI/AAAAAAAAy9A/K13EeHK67NM69FUaCYDYtunHofUHjtt4wCLcBGAs/s260-e100/hacking-cybersecurity-books.jpg'/> Cybersecurity Certification Training CISA, CISM, CISSP, PMI-RMP, and COBIT 5 certifications.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-complete-2020-comptia-certification-training-bundle
Title: <img alt='Cisco Certification Courses' class='deal-link' src='https://thehackernews.com/images/-2nVCe__qYkc/WxVG9s8C7CI/AAAAAAAAw6Q/fFsdOSE-DEYDqqf3z9KWus0oBWdbzAkAgCLcBGAs/s260-e100/cisco-it-networking-certification.png'/> CompTIA IT Certification Training Lifetime access to 14 expert-led courses.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/citizengoods-exclusives
Title: Exclusives

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/hacking
Title: Hacking

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-specialization-developer
Title: Development

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-interest-android
Title: Android

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/doTlgCbdJ1 Page URL
https://bit.ly/2J4lxHW HTTP 301
https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244864;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244864;dc_pre=CMO42YWXnu0CFY-EewodaHQLpQ;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://d.agkn.com/pixel/2388/?che=1004103&col=23636320,5936378,269244864,462128157,112547680&l2=https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378 HTTP 302
https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378 HTTP 302
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378

Request Chain 31

https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244987;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244987;dc_pre=CPDB2YWXnu0CFWvuuwgdGCcLAw;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://d.agkn.com/pixel/2388/?che=2605826496&col=23636320,5936378,269244987,462128157,112547680&l2=https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378 HTTP 302
https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378 HTTP 302
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378

60 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 doTlgCbdJ1
t.co/ 221 B
358 B 135ms
135ms Document
text/html 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /doTlgCbdJ1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 176
content-type: text/html; charset=utf-8
date: Wed, 25 Nov 2020 17:05:53 GMT
expires: Wed, 25 Nov 2020 17:10:53 GMT
server: tsa_o
set-cookie: muc=293871c8-e1db-4a38-a9cb-6ca0937c6351; Max-Age=63072000; Expires=Fri, 25 Nov 2022 17:05:53 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 06d8f6ce56fda4426bf1281a00d037e3
x-response-time: 113
x-xss-protection: 0

GET
H2

200

Primary Request anyrun-emotet-malware-analysis.html Show response
thehackernews.com/2020/11/
Redirect Chain

https://bit.ly/2J4lxHW
https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

136 KB
45 KB

307ms
289ms

Document
text/html

2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / WordPress VIP

Resource Hash

5af1c25ec6f805099823bdf6d255424a9fd5ea7fb97afaa4754cd320de8529a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: thehackernews.com
:scheme: https
:path: /2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://t.co/doTlgCbdJ1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://t.co/doTlgCbdJ1

Response headers

date: Wed, 25 Nov 2020 17:05:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d932cd23bf036f58b96997082c78f8bfd1606323953; expires=Fri, 25-Dec-20 17:05:53 GMT; path=/; domain=.thehackernews.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 5f7cf506afbc2bd2-FRA
cache-control: private, max-age=0
expires: Wed, 25 Nov 2020 17:05:53 GMT
last-modified: Wed, 25 Nov 2020 07:14:18 GMT
link: </css/roboto.css>; as=style; rel=preload
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-request-id: 06a1f7782d00002bd275a53000000001
content-security-policy: upgrade-insecure-requests
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: DENY
x-powered-by: WordPress VIP
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=QfUuqvr2%2Fqh6Rsp3IC1Ae5vosIgFjqy95zuOT0iZRyqgtypHVe4jpBXUBC1K7NaIov1j19XEuRa95bPtFM0TUc8LhHKlVfRwa5IfRJNioO0xLj7jvt0p7voWjXUl9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
content-encoding: br
cf-h2-pushed: </css/roboto.css>

Redirect headers

server: nginx
date: Wed, 25 Nov 2020 17:05:53 GMT
content-type: text/html; charset=utf-8
content-length: 253
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
referrer-policy: unsafe-url
set-cookie: _bit=kaph5R-e7a7f2b5be526a2d44-001; Domain=bit.ly; Expires=Mon, 24 May 2021 17:05:53 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 roboto.css
thehackernews.com/css/ 77 KB
58 KB 12ms
0ms Stylesheet
text/css 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/css/roboto.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NnR0waLHX3Io%2FlSiO7kEYXed%2FSbHZrAOdqzONc7zUZHY9OSUDyipVgCsBlZetr3BxuuBZcv%2BP%2Fojxm7CxWxmBTj%2BsmoqKideNrfC6wQk6THN7Y4pW%2BR8XV0c%2B0jq6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=2592000, immutable
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 5f7cf5087c6e2bd2-FRA
cf-request-id: 06a1f7794700002bd26489b000000001

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 13ms
12ms Script
application/javascript 2606:4700::6810:a823
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-request-id: 06a1f7795d00002c5612397000000001
last-modified: Tue, 24 Nov 2020 15:06:25 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"5fbd2171-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DaoZpDcXh36NkgrMid0PITDo1uOPpVuIO0pafKfjsZ51ubMn%2F5MEiBK7S%2BHn%2Bp9eu98%2FYDfaEXdlZoJ5m975a7VP7WPt%2B%2B6iZ%2FDk5V0NnmtjWS%2FJQzx4grBq%2BgSl0ilJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5f7cf508999a2c56-FRA
expires: Fri, 27 Nov 2020 17:05:54 GMT

GET
H2 200 emotet-malware.jpg
thehackernews.com/images/-tdYBXkkEvpk/X7ZTW3d-D8I/AAAAAAAA3a0/bwmwGq4gZuYr6FbHRO8gsv0Ko13Cn7eNgCLcBGAsYHQ/s728-e1000/ 26 KB
27 KB 56ms
56ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-tdYBXkkEvpk/X7ZTW3d-D8I/AAAAAAAA3a0/bwmwGq4gZuYr6FbHRO8gsv0Ko13Cn7eNgCLcBGAsYHQ/s728-e1000/emotet-malware.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77e533c9ddcf0669d6eb1be6c37dca819419230dce7f3ebdd1c752ad820fed5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 205009
cf-polished: origSize=27940, status=webp_bigger
content-disposition: inline;filename="emotet-malware.jpg"
vary: Accept-Encoding
content-length: 26771
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "vddae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pyq4OJBbH2Ve30jmYI42AoCE0CzyZ%2Bghy7b%2B1TIqSUl%2BPCtay61kG5qbVO8W61yvnOxjoQDo26JyEg%2Bqnc8%2FhadE53g5sb1amsLvGbKxLL8L0GzZ88%2F6Bz4u6QgVDg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7796500002bd249335000000001
accept-ranges: bytes
cf-ray: 5f7cf508acda2bd2-FRA
expires: Sun, 20 Aug 2023 08:05:06 GMT

GET
H2 200 emotet-malware-1.jpg
thehackernews.com/images/-RTEEM7UOZG4/X7U7R2AV09I/AAAAAAAAAoQ/BmmBMTH3lbACDJvhF586-J5xqHzrmZ-OgCLcBGAsYHQ/s728-e1000/ 59 KB
59 KB 45ms
42ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-RTEEM7UOZG4/X7U7R2AV09I/AAAAAAAAAoQ/BmmBMTH3lbACDJvhF586-J5xqHzrmZ-OgCLcBGAsYHQ/s728-e1000/emotet-malware-1.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c6d678bff0699e60890679e43ea69fd33dcee8091528994c2995ef557fe9bcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 203274
cf-polished: origSize=63073, status=webp_bigger
content-disposition: inline;filename="emotet-malware-1.jpg"
vary: Accept-Encoding
content-length: 60136
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v285"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Rj40FWDJcsNZagix1y%2FA%2FnEw%2FDyCViQ6vy71kC7Y4Xv%2BsBQhXxFSFO0C29Q3FQXWhMWrgxLwEZSHdDOMX6XalgsutcAgZ6h75OJcmp8U47UPcKXMjl96X71owM%2BCNg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7796d00002bd285b59000000001
accept-ranges: bytes
cf-ray: 5f7cf508acfb2bd2-FRA
expires: Sun, 20 Aug 2023 08:38:00 GMT

GET
H2 200 emotet-malware-2.jpg
thehackernews.com/images/-8A3_4jBSB1M/X7U7jXVQKcI/AAAAAAAAAoY/xGwAQ5qAAwY6F7Kra2ayD-YOL2J7Mj4jACLcBGAsYHQ/s728-e1000/ 63 KB
64 KB 37ms
36ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-8A3_4jBSB1M/X7U7jXVQKcI/AAAAAAAAAoY/xGwAQ5qAAwY6F7Kra2ayD-YOL2J7Mj4jACLcBGAsYHQ/s728-e1000/emotet-malware-2.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e37a0a73d3775b46a4d266f090ff2fc52a3243a8645dc765d8481cd0e2f56997

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 203472
cf-polished: origSize=70666, status=webp_bigger
content-disposition: inline;filename="emotet-malware-2.jpg"
vary: Accept-Encoding
content-length: 64965
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v287"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BiqV%2F26fjTRT4RAKgjQ0Ys2AEQSZaa4%2FVIOEEUrSW%2BBJ8POLpYg%2Fr7J5Ce19MEGXh441HXyARmb14dxtLOgVYIov3mC26d20kopeaH5WdakKN6k8rwZSaIpahSr0pA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7797700002bd271955000000001
accept-ranges: bytes
cf-ray: 5f7cf508bd142bd2-FRA
expires: Sun, 20 Aug 2023 08:34:42 GMT

GET
H2 200 emotet-malware-3.jpg
thehackernews.com/images/-c7kHRcUU7tQ/X7U72q7K1uI/AAAAAAAAAog/p85fqoaXoxMXL02CoNlTTiNaRzwAt2sMwCLcBGAsYHQ/s728-e1000/ 43 KB
43 KB 38ms
37ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-c7kHRcUU7tQ/X7U72q7K1uI/AAAAAAAAAog/p85fqoaXoxMXL02CoNlTTiNaRzwAt2sMwCLcBGAsYHQ/s728-e1000/emotet-malware-3.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9370f4d728086e469b91e50321a7892aa3272e5c9d14787ce8fad1d6848e7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 203472
cf-polished: origSize=46859, status=webp_bigger
content-disposition: inline;filename="emotet-malware-3.jpg"
vary: Accept-Encoding
content-length: 43843
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v289"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cItLSkoTNbXWB%2Bqg0U7GRQIzXZTQmosJBpwyz%2BGuv5LvX%2FXFq%2BjST2s7YmEvvMwjyNxMj0uKw9eP7PeiMZA7bDVJPE0JQVQ2cNnix4imB%2Fd5PipNJLNmCoEqWfp3EQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7797800002bd2833aa000000001
accept-ranges: bytes
cf-ray: 5f7cf508bd1a2bd2-FRA
expires: Sun, 20 Aug 2023 08:34:42 GMT

GET
H2 200 emotet-malware-4.jpg
thehackernews.com/images/-GNZZ1fGy28k/X7ZUC13mTlI/AAAAAAAA3a8/DzlWwdvsZ7E-BOYPuPZk81f87IAy4uINACLcBGAsYHQ/s728-e1000/ 58 KB
59 KB 37ms
36ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-GNZZ1fGy28k/X7ZUC13mTlI/AAAAAAAA3a8/DzlWwdvsZ7E-BOYPuPZk81f87IAy4uINACLcBGAsYHQ/s728-e1000/emotet-malware-4.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d86dac52c474df393d33a1dd373fbedbc3afd632b2d0f79a4d03fdbaa530f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 203472
cf-polished: origSize=63510, status=webp_bigger
content-disposition: inline;filename="emotet-malware-4.jpg"
vary: Accept-Encoding
content-length: 59787
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "vddb0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PEMuPJ%2FZ2TXGdAnBryWWx772%2FI0b6OlkhRbfDysXI47P1IAdaC18fczUyLamlFg6Sw%2F%2BPMjOcgl3l%2BaLnoQMGVmsURvL5lTNHtYFbQeJBVh6tfBtVdzA5KtAF22ECw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7797800002bd2a7b9c000000001
accept-ranges: bytes
cf-ray: 5f7cf508bd1b2bd2-FRA
expires: Sat, 19 Aug 2023 20:14:49 GMT

GET
H2 200 emotet-malware-5.jpg
thehackernews.com/images/-Sd2qrw1UROg/X7U8SfGmHSI/AAAAAAAAAos/Gc-EFk1yIhAuvgvyBlBaKoVHlDHsgxhdQCLcBGAsYHQ/s728-e1000/ 41 KB
42 KB 43ms
42ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-Sd2qrw1UROg/X7U8SfGmHSI/AAAAAAAAAos/Gc-EFk1yIhAuvgvyBlBaKoVHlDHsgxhdQCLcBGAsYHQ/s728-e1000/emotet-malware-5.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03007e9dd0b10e60b4c8a4e71496b40dc8026aa60b97c3e54381aa5b2cb39d06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 203472
cf-polished: origSize=45648, status=webp_bigger
content-disposition: inline;filename="emotet-malware-5.jpg"
vary: Accept-Encoding
content-length: 42241
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v28c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YjXmYRXBZ%2FM2DqunjP8GpgIVeW5%2FOAmkksNXiIZgLl4KQ3mxXTZNZ4K69lGwbcR%2BwrYILPvbaWI8dfuJtOUsJ9IIcKlHJhAUIWV0KFsa5cafKmcd1nEtWAdOO%2BoSqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7797800002bd29f815000000001
accept-ranges: bytes
cf-ray: 5f7cf508bd1c2bd2-FRA
expires: Sun, 20 Aug 2023 08:34:42 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 194 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 19 KB
19 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32c80a55d06b9da550f41424241174895bdbe1dd174ee1d015a4d56747cd2a99

Request headers

Origin: https://thehackernews.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a

Request headers

Origin: https://thehackernews.com
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 19 KB
19 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f03c3526dd6db1c340c972db0194f8b732611626e1bcde62426d70a68c7a023b

Request headers

Origin: https://thehackernews.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 19 KB
19 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe94fcc14c2b9f93c39cbe038796bff0ebc07a140ebd15e66b3a897b6a25bc82

Request headers

Origin: https://thehackernews.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 129 KB
44 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66de80f5c91d14f0c4d222a82eea52a01ab8d8e907f3df2e08a7c4bc1d4ec33d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45286
x-xss-protection: 0
server: cafe
etag: 14933426052519692593
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ 5 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b12bb715457df01fa8b72b9fefc294fec56b5108b37a209788e5621b011b5af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 16:52:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Nov 2020 22:20:41 GMT
server: sffe
age: 795
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 2478
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:52:39 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/37020/ 396 KB
141 KB 53ms
18ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/37020/adpushup.js
Requested by: Host: t.co
URL: https://t.co/doTlgCbdJ1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: abaf592391fb0a053a8706690458ca1b77f6502595b88c3d34feb040cf66dee6

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 604800.000
x-cf1: 28371:fB.ams1:co:1606219024:cacheN.ams1-01:H
x-cf-geodata: false
content-length: 144338
x-cf-tsc: 1606219362
x-cf2: H
last-modified: Tue, 24 Nov 2020 11:57:22 GMT
server: CFS 0215
x-cff: B
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=900
cf4age: 319
accept-ranges: bytes
x-cf-rand: 29.992
expires: Wed, 25 Nov 2020 17:20:54 GMT

GET
H3-Q050 200 impl_v66.js Show response
www.googletagservices.com/dcm/ 32 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v66.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afb01d2aa20ad23da0238c979259816feb72ff155e7649c4edebd4ca741964ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 10:49:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 03 Nov 2020 17:45:19 GMT
server: sffe
age: 22608
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 13222
x-xss-protection: 0
expires: Thu, 25 Nov 2021 10:49:06 GMT

GET
H2 200 B24029648.272043563;dc_ver=66.187;sz=728x90;u_sd=1;dc_adk=4037400832;ord=kzvt8j;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%... Show response
ad.doubleclick.net/ddm/adj/N510001.3381407THEHACKERNEWS/ 36 KB
16 KB 50ms
49ms Script
text/javascript 216.58.210.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N510001.3381407THEHACKERNEWS/B24029648.272043563;dc_ver=66.187;sz=728x90;u_sd=1;dc_adk=4037400832;ord=kzvt8j;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894$0;xdt=0;crlt=UlIE8O0ca3;sttr=19;prcl=s

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f6.1e100.net

Software

cafe /

Resource Hash

bb10cecea4a21be92d92b0564c43ddebff5ae08de856f557bbb0b6e3c6881a62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16009
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ 111 KB
39 KB 25ms
5ms Script
text/javascript 2a00:1450:4001:81a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://thehackernews.com
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 24 Nov 2020 22:07:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68315
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Nov 2020 22:07:19 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20201112/r20110914/elements/html/ 6 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201112/r20110914/elements/html/omrhp.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa3748e2366d5ba5f4a7b6c8154809725b6bfb7843743837384c70f060b33503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 15:56:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 2649
x-xss-protection: 0
server: cafe
etag: 804181672847865866
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Dec 2020 15:56:05 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ 41 KB
15 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 12:50:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15344
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Nov 2021 12:50:10 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 6606
date: Wed, 25 Nov 2020 15:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Wed, 25 Nov 2020 17:15:48 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 87 KB
28 KB 18ms
17ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 454064
x-via: cfworker/kv
cross-origin-resource-policy: cross-origin
content-length: 27964
cf-request-id: 06a1f77bb10000d6b9bb040000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
etag: "5eb03ec4-15d95"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ejU4C7cxOfsr9mzL%2BDzfRkgJIGf7qJOtMbZ8jBni53f72JsJvNc4Qh%2FsKT27Hs%2BsXqEE74Z1ws4PTnx%2F0D70APL94otvYUPW0CRO0UOkoemUBB3WdP%2BhBXyQ6qQPPOSVrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5f7cf50c4e78d6b9-FRA
expires: Mon, 15 Nov 2021 17:05:54 GMT

GET
DATA 200
OK truncated
/ 103 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 group-a-300.jpg
thehackernews.com/images/-6vhDJ-T9u_Q/Xl_LzZu_HBI/AAAAAAAA2dU/TkjBhLSQXUQxJ5_hxArrnTW3PXn0rDRFQCLcBGAsYHQ/s728-e100/ 35 KB
36 KB 20ms
18ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-6vhDJ-T9u_Q/Xl_LzZu_HBI/AAAAAAAA2dU/TkjBhLSQXUQxJ5_hxArrnTW3PXn0rDRFQCLcBGAsYHQ/s728-e100/group-a-300.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca85db932ecb7fd8d5fdd101ac11e815bec5cfc59f74220d9af2c2d01069ab80

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 204876
cf-polished: origSize=36120, status=webp_bigger
content-disposition: inline;filename="group-a-300.jpg"
vary: Accept-Encoding
content-length: 36010
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "vd9d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=srhjgtMj66xeRUJ4La308c8evNOPFzOf96RwTX4mJ%2BrHSc8K0tICbp%2Fi7YLtSfgEB195%2BptmHTrsNs5OmlGqtF%2BfwPsSFd%2FhGFsD79eLsBXomy7xCXNZB0Aa96MxlA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77bb400002bd2971f9000000001
accept-ranges: bytes
cf-ray: 5f7cf50c5ea32bd2-FRA
expires: Wed, 03 Mar 2021 08:09:36 GMT

GET
H/1.1

200
OK

firstevent
att.demdex.net/
Redirect Chain

https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244864;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244864;dc_pre=CMO42YWXnu0CFY-EewodaHQLpQ;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_ch...
https://d.agkn.com/pixel/2388/?che=1004103&col=23636320,5936378,269244864,462128157,112547680&l2=https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=...
https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378

42 B
915 B

50ms
50ms

Image
image/gif

54.170.224.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.170.224.115 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-170-224-115.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v086-020781a86.edge-irl1.demdex.com 5.80.1.20201111130852 6ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: r9jrkFahQ5Y=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: J2oGhb3DTTU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244864&d_campaign=23636320&d_site=5936378
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 group-a-728.jpg
thehackernews.com/images/-hE5p9WwWcnA/Xl_LzY65f-I/AAAAAAAA2dY/zIlLKD-Uv1EMGUzImckTKEroMsdYbGi_ACLcBGAsYHQ/s728-e100/ 23 KB
23 KB 20ms
19ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-hE5p9WwWcnA/Xl_LzY65f-I/AAAAAAAA2dY/zIlLKD-Uv1EMGUzImckTKEroMsdYbGi_ACLcBGAsYHQ/s728-e100/group-a-728.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48d9017b2b7d479fe837cabcdb9ca891f7af55828c84e8b307b9843d45d7a527

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 204876
cf-polished: origFmt=jpeg, origSize=31429
content-disposition: inline; filename="group-a-728.webp"
vary: Accept, Accept-Encoding
content-length: 23438
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "vd9d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DvHbDaPyZyz6GkR0kJI9xsCK%2BmD%2BaFAr8LHm15vnlRe1H2Qc2jfSn76lir2qEbI6Kh5o6sBkJ%2BklaJrFvG0DKMQNnP5WcUT%2B1sflJsXBmpYYM4410j3Rt905GIfyzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77bb500002bd235bd3000000001
accept-ranges: bytes
cf-ray: 5f7cf50c5ea62bd2-FRA
expires: Sun, 28 Feb 2021 04:56:49 GMT

GET
H/1.1

200
OK

firstevent
att.demdex.net/
Redirect Chain

https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244987;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/ad/N424004.3381407THEHACKERNEWS/B23636320.269244987;dc_pre=CPDB2YWXnu0CFWvuuwgdGCcLAw;sz=1x1;u=__AP1_np_dv_qi52yx0sygnPA__;ord=72883451055;dc_lat=;dc_rdid=;tag_for_ch...
https://d.agkn.com/pixel/2388/?che=2605826496&col=23636320,5936378,269244987,462128157,112547680&l2=https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placeme...
https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378

42 B
915 B

48ms
48ms

Image
image/gif

54.170.224.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.170.224.115 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-170-224-115.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v086-07f29a887.edge-irl1.demdex.com 5.80.1.20201111130852 6ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: 0/40AA8wRNE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: GnB4Bm8OQdg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=112547680&d_placement=269244987&d_campaign=23636320&d_site=5936378
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/ 231 KB
87 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad7386d16a056df5c235702a97a5fa4cee68e302d71041aa35df96151f756f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 88601
x-xss-protection: 0
server: cafe
etag: 4353532171737760018
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/ Frame F43C 0
0 8ms
7ms Document
text/html 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201112/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 25 Nov 2020 01:05:46 GMT
expires: Wed, 09 Dec 2020 01:05:46 GMT
content-type: text/html; charset=UTF-8
etag: 5228831996244654541
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4745
x-xss-protection: 0
age: 57608
cache-control: public, max-age=1209600
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Facebook-Messenger.jpg
thehackernews.com/images/-5h0cbqLZJA0/X7d-wlTNfNI/AAAAAAAABEo/0HT97iVYqgIH_2WBCkvnwiYnviJvWhcdgCLcBGAsYHQ/s72-c-e100/ 3 KB
3 KB 18ms
17ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-5h0cbqLZJA0/X7d-wlTNfNI/AAAAAAAABEo/0HT97iVYqgIH_2WBCkvnwiYnviJvWhcdgCLcBGAsYHQ/s72-c-e100/Facebook-Messenger.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1d4010571ffd2f95866503d163abc2a0e0c8fb3d3f540fb112fe0ecfbaae3dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 70223
cf-polished: origFmt=jpeg, origSize=3061
content-disposition: inline; filename="Facebook-Messenger.webp"
vary: Accept, Accept-Encoding
content-length: 2800
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v44b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2F2ZXqvpdF4qmnQ6DBx0Qo674RKaBqGhHH6S2NgfJQcyugaNjf1Ao%2F4ozHAjLPOPaj%2FFucCxgyJ4TdYM%2FiM2xJqU0jS1UdYSnRpYCXjxkBRFqHQoD509o9Bwvy76%2BRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77bd700002bd239955000000001
accept-ranges: bytes
cf-ray: 5f7cf50c8f252bd2-FRA
expires: Tue, 02 Mar 2021 04:07:03 GMT

GET
H2 200 emotet-malware.jpg
thehackernews.com/images/-tdYBXkkEvpk/X7ZTW3d-D8I/AAAAAAAA3a0/bwmwGq4gZuYr6FbHRO8gsv0Ko13Cn7eNgCLcBGAsYHQ/s72-c-e100/ 2 KB
3 KB 44ms
43ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-tdYBXkkEvpk/X7ZTW3d-D8I/AAAAAAAA3a0/bwmwGq4gZuYr6FbHRO8gsv0Ko13Cn7eNgCLcBGAsYHQ/s72-c-e100/emotet-malware.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ebc145db72bab02fc2b92ca74574394c4076c74605515a04282f1125c2657f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 205034
cf-polished: status=not_needed
content-disposition: inline;filename="emotet-malware.jpg"
vary: Accept-Encoding
content-length: 2383
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "vddae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=X1u3g%2FHSeCo4L1j%2FpRlwzEYkHnp11qriUpLNGK5QWBPQhWgALy5hiCdcvoGIu1Zb5ipi5gTGr2E%2BFiKf9Vx%2FXj6aIv6NPYlj8AtpfQQHUim%2FCC55idu0%2B1shuWeMYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77bd800002bd260035000000001
accept-ranges: bytes
cf-ray: 5f7cf50c8f272bd2-FRA
expires: Mon, 01 Mar 2021 04:11:57 GMT

GET
H2 200 pb.1603122100783.js Show response
cdn.adpushup.com/prebid/ 352 KB
134 KB 18ms
18ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.1603122100783.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 1441d1ad3cfe24d4e8146e26cee90908ded2df81328119d5c2bb8a38a52f6ed8

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 604800.000
x-cf1: 28371:fB.ams1:co:1603122158:cacheN.ams1-01:H
content-length: 137101
x-cf-tsc: 1605765990
x-cf2: H
last-modified: Mon, 19 Oct 2020 15:42:38 GMT
server: CFS 0215
x-cff: B
etag: "5f8db3ee-5806a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
cf4age: 223962
accept-ranges: bytes
x-cf-rand: 99.345
expires: Wed, 02 Dec 2020 17:05:54 GMT

POST
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
178 B 61ms
19ms Other
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
ap-cookie-status: cookies ap_uid and ap_usid not set due to GDPR
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 54 KB
18 KB 58ms
58ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

2e527a3483125d104275304b1fe7dcd1e83ac2bbc1ea65a94eea2184e513cdd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "704 / 741 of 1000 / last-modified: 1606134076"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18520
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 114 KB
29 KB 65ms
23ms Script
application/javascript 52.84.134.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.134.201 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-134-201.ams50.r.cloudfront.net
Software: Server /
Resource Hash: c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:03:46 GMT
content-encoding: gzip
server: Server
age: 127
etag: 14b87a812615d68493a97e70b7b323fb
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 abc3ecd1d98ae9cd426d47386509de19.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: AMS50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: RG_hoG4WuXYplJA_xrZyu9TCiowwKfv7cxkzkYSsE_0pRHT5pjCvVQ==

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
273 B 44ms
17ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2MDYzMjM5NTQ3MDYsInBhY2tldElkIjoiMDAwMDkwOUMtNWUyZTNhZWYtYmZmYi00OGIzLTgyZDctYzUxOTE2MDE2MmNlIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIwLzExL2FueXJ1bi1lbW90ZXQtbWFsd2FyZS1hbmFseXNpcy5odG1sP3V0bV9jb250ZW50PTE0Njg4MjAxNyZ1dG1fbWVkaXVtPXNvY2lhbCZ1dG1fc291cmNlPXR3aXR0ZXImaHNzX2NoYW5uZWw9dHctMjUxNzE2Mjg5NCIsIm1vZGUiOjIsImVycm9yQ29kZSI6NSwicmVmZXJyZXIiOiJodHRwczovL3QuY28vZG9UbGdDYmRKMSIsInBhZ2VHcm91cCI6IlBPU1QiLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpudWxsfQ==
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H3-Q050 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 9AC6 0
0 7ms
6ms Document
text/html 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 25 Nov 2020 12:50:12 GMT
expires: Thu, 25 Nov 2021 12:50:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 15342
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
69 B 16ms
15ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=92915539&t=pageview&_s=1&dl=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&dr=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&ul=en-us&de=UTF-8&dt=Evolution%20of%20Emotet%3A%20From%20Banking%20Trojan%20to%20Malware%20Distributor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1751835576&gjid=1976363567&cid=324442587.1606323955&tid=UA-27389293-1&_gid=1065764433.1606323955&_r=1&_slc=1&z=27732836

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ 103 KB
32 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae9daae5c7e9177b48cf7e63c72537535d98efdf02ed86021f4c780975ba57a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1605702992033219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 32299
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H3-Q050 200 Gartner-Oct2020-728x90.html
s0.2mdn.net/8532760/1604331588775/728x90/ Frame FD6D 0
0 44ms
26ms Document
text/html 2a00:1450:4001:81a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8532760/1604331588775/728x90/Gartner-Oct2020-728x90.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8532760/1604331588775/728x90/Gartner-Oct2020-728x90.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2352
date: Wed, 25 Nov 2020 06:32:47 GMT
expires: Thu, 26 Nov 2020 06:32:47 GMT
last-modified: Mon, 02 Nov 2020 15:39:48 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 37987
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ 0
674 B 99ms
36ms Other
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBi17CU77OaxHtT2cWqoI0XpmVmA59yaRdL1Otp61TS97uHxLQnYwsu4Ud2kdYZkg8GQhwD9ttQEpXfQMwX870lgpMgfl_12jYdd25Vc0cUZeD10KIoqnQMg4IZbe9&sig=Cg0ArKJSzP3bRIm4LBFvEAE&urlfix=1&omid=0&rm=1&ctpt=201&cbvp=1&cstd=198&cisv=r20201112.82032&adurl=

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
89 B 20ms
13ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-27389293-1&cid=324442587.1606323955&jid=1751835576&gjid=1976363567&_gid=1065764433.1606323955&_u=IEBAAEAAAAAAAC~&z=430086408

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 25 Nov 2020 17:05:54 GMT
content-type: text/plain
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 207 B
443 B 45ms
30ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=thehackernews.com&callback=_gfp_s_&client=ca-pub-7983783048239650

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

5bb0266a4f2d90f99ba4941de76b1ca90fc12ac0e2dd4345a6409d09c61c3733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
169 B 26ms
19ms Script
application/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thehackernews.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
169 B 26ms
19ms Script
application/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thehackernews.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 84AC 0
0 89ms
89ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&adk=1812271804&adf=3025194257&lmt=1606288458&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954621&bpp=14&bdt=621&idt=216&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6016176465343&frm=20&pv=2&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=9127373482&dssz=39&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=251

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&adk=1812271804&adf=3025194257&lmt=1606288458&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954621&bpp=14&bdt=621&idt=216&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6016176465343&frm=20&pv=2&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=9127373482&dssz=39&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=251
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkxxeuECxI7clRC6R4j9JqOfCE9utem5pp_dY6-TNJdthtZcY_iTKZihbUG
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Nov 2020 17:05:54 GMT
server: cafe
content-length: 34
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
6 KB 18ms
18ms XHR
application/json 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201112&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

009c644478ab408df7eb9043ff663c714c681064ccb1fe56be1e3078f9ce65f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6460
x-xss-protection: 0

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1605702985553312"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28207
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 34ms
30ms Image
image/gif 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-27389293-1&cid=324442587.1606323955&jid=1751835576&_u=IEBAAEAAAAAAAC~&z=1683059216

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 35ms
31ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-27389293-1&cid=324442587.1606323955&jid=1751835576&_u=IEBAAEAAAAAAAC~&z=1683059216

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 9208 0
0 361ms
360ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&h=600&slotname=3616315140&adk=1702816697&adf=3546401298&pi=t.ma~as.3616315140&w=300&fwrn=4&fwrnh=100&lmt=1606288458&rafmt=1&psa=0&format=300x600&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954635&bpp=4&bdt=635&idt=288&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6016176465343&frm=20&pv=1&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=146566326954&dssz=40&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1031&ady=701&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=zIqvgA6fFO&p=https%3A//thehackernews.com&dtd=299

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?npa=1&guci=1.2.0.0.2.1.0.0&client=ca-pub-7983783048239650&output=html&h=600&slotname=3616315140&adk=1702816697&adf=3546401298&pi=t.ma~as.3616315140&w=300&fwrn=4&fwrnh=100&lmt=1606288458&rafmt=1&psa=0&format=300x600&url=https%3A%2F%2Fthehackernews.com%2F2020%2F11%2Fanyrun-emotet-malware-analysis.html%3Futm_content%3D146882017%26utm_medium%3Dsocial%26utm_source%3Dtwitter%26hss_channel%3Dtw-2517162894&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606323954635&bpp=4&bdt=635&idt=288&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6016176465343&frm=20&pv=1&ga_vid=324442587.1606323955&ga_sid=1606323955&ga_hid=92915539&ga_fc=0&iag=0&icsg=146566326954&dssz=40&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1031&ady=701&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=3690235860270297&pem=454&ref=https%3A%2F%2Ft.co%2FdoTlgCbdJ1&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=zIqvgA6fFO&p=https%3A//thehackernews.com&dtd=299
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkxxeuECxI7clRC6R4j9JqOfCE9utem5pp_dY6-TNJdthtZcY_iTKZihbUG
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Nov 2020 17:05:55 GMT
server: cafe
content-length: 20904
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 51ms
47ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:05:54 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ 0
30 B 50ms
49ms Other
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: t.co
URL: https://t.co/doTlgCbdJ1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 25 Nov 2020 17:05:54 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 pubads_impl_2020111701.js Show response
securepubads.g.doubleclick.net/gpt/ 277 KB
98 KB 59ms
55ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 Nov 2020 09:43:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99766
x-xss-protection: 0
expires: Wed, 25 Nov 2020 17:05:54 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 57ms
16ms XHR
application/javascript 52.84.134.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.134.201 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-134-201.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 02:01:20 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 54275
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 ec354e6d520d6c5c48f3933476169123.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: AMS50-C1
x-amz-cf-id: y7cMJZP5VZjbO6CgE75pqOaP8Rj33jDVOC3-toNVmzEwaCbdeId0bA==

GET
H2 200 industry.jpg
thehackernews.com/images/-qf946OVrzD4/X7YjTQJCqsI/AAAAAAAABDw/BKCrdm1lTRE1B4KrbkG1P87pEFJ6svoLgCLcBGAsYHQ/s72-c-e100/ 4 KB
4 KB 25ms
25ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-qf946OVrzD4/X7YjTQJCqsI/AAAAAAAABDw/BKCrdm1lTRE1B4KrbkG1P87pEFJ6svoLgCLcBGAsYHQ/s72-c-e100/industry.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d89310e4beb6184b3f8f1f5eb196d88c1218f3b23af9345278c3c29d7090746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 147757
cf-polished: status=not_needed
content-disposition: inline;filename="industry.jpg"
vary: Accept-Encoding
content-length: 3857
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v43d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DmEMxndPUpbRY94ka7SQyY46ayz60LFlsazb6K0vLq3okGTCWpyPm8FdpF8Kldr0xds9TYxs6JiXymUzMT32TT6d7Pfj0DrPa1Z9BkAXl0TewtG6gznOGjgw4%2BL1NA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77d7500002bd289b6c000000001
accept-ranges: bytes
cf-ray: 5f7cf50f2ed42bd2-FRA
expires: Thu, 04 Mar 2021 00:03:18 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame DD1B 0
0 6ms
6ms Document
text/html 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://thehackernews.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4867
date: Wed, 25 Nov 2020 16:12:32 GMT
expires: Thu, 25 Nov 2021 16:12:32 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3203
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 go-pro-sms-hack.jpg
thehackernews.com/images/-xXEa24Rf0v8/X7Zb9of_rmI/AAAAAAAABEQ/3i7AHndNBE0Au_yNENjZdF7_YJj0sLxrwCLcBGAsYHQ/s72-c-e100/ 3 KB
4 KB 19ms
18ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-xXEa24Rf0v8/X7Zb9of_rmI/AAAAAAAABEQ/3i7AHndNBE0Au_yNENjZdF7_YJj0sLxrwCLcBGAsYHQ/s72-c-e100/go-pro-sms-hack.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

805009383730a2d52e65d5a15df0bf9f05b9784a7c3ae0785ca8a461787f846d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 61480
cf-polished: origFmt=jpeg, origSize=3812
content-disposition: inline; filename="go-pro-sms-hack.webp"
vary: Accept, Accept-Encoding
content-length: 3270
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v445"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1G159UaNavqTkpfND%2Fq%2BI%2BHIJINlCLCRAkkUla8Mg9F8kBVifmDO5Jspc6%2Fa%2B%2Fsk62IuPk%2B5y%2B4RrgbokP1FRqta6txkdZl1drP%2FsGOD5AxqeVkNQmiSZErZmC3b7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77dc100002bd26120b000000001
accept-ranges: bytes
cf-ray: 5f7cf50f98352bd2-FRA
expires: Tue, 02 Mar 2021 02:57:17 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 42ms
42ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201112&jk=3690235860270297&bg=!srGlsZHNAAVGySeIRlgNHsavGWkjOgIAAABYUgAAAA1oAQcKAXSHqP0hsYjOrJiqugLk2PGuv1usXTvZlrx4sNjr4edEpxmfR6okv-H3O7KV8oEpx_IiKETTQn2q4IUpWlA2ebcghKn5mTRhLDYPxfswL0DOkugJLWeAlt6wim-JU0FoOSQ0ctB353i_VhaYGc-dGoW9xweSMb_IiuhYxchG1EA-NEtNNO4I-Zb7ZHfGYmc1ilTRPn_Oe5RC0eIgP3dnLdC7Ho3Jr3b3v1W2DzOJDfSaJDkjGzMg0g2RAiLHjr_Q2Uzh93YQ-M2RPDzJUdHGBsPEay802zBt9wjeHqhme-cJqVk1KIjhwue7IVcvm_4PJcXFUfEjf-Z7uV8kItwnHbGIHnN3J_RzpwHie9MRhUU5xInOLNM0p5Sj0pKVpEBEgBT67Mu8mrD-q_Z_bIx_xSzOjyCudkgBIfjCZEyvq9EXuieAWolrsKVGdbSDFL-yp6_jrkjsg75W5J5mV-D2FCMszE6ZbJ-DpjA9xBOCAD-lQ_DBiseZAboHNaHjYGByBYvbhQIeyM_ov4KMkxx5tQDq2-vn3XsqoZD1Mlgh7d9GfUkTixIQkZOBJmmnpzmT9ttIztbkI2gWcnbnBUkiqE5EXj8Ilhu_qhaNqWRLZkyd4V6ELI9j5nAfpg-T603utm07wVtKE5FaIE2KcsavGuo-r3ErVht21zlXZv6DINp481N0zgeUn9lVZVVu_qt_F0vKcyxmxiZOQK-6Yo_xUAQXQTWLfgcTlhwc1uVgA3Gz_AlyMApQxqOK_e0DDXdJjdSYmuzFczE4E8EWJYbsZsvAGp5FYOTjhUXYWRmg_cYFM3yHf3qlAwP4W2XlEo-HwMDKMCGM-i_PcfjbPEG6XXwyReVnS-bjOeMNPLpdTp_FDNrxf6Tr6oMeyWlmDnt4UOq10sqj5KlKeBrYikcjgRbXwLWPEg8tjs7B1zsC0Dtkjju5dy_yHDYnOaTU8vsUsDfkTUk-UhCaXN8dAP0s70H0wAFtQuqAn_lftrgaordCpJJe3SJ6vpBaEINkodnxM15xJ_Vcs8102k7yJsLy8JgyHRLGDjAcpbiw3MSBR9RzkI2bTm_Tb57naPAoy0kWorgt

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 waf.jpg
thehackernews.com/images/-82nxwLbf6hY/X7tdR2dBoAI/AAAAAAAAApE/_sLSdFJFVG8U60wY4jwHs_5n5aJBf0hLACLcBGAsYHQ/s72-c-e100/ 5 KB
6 KB 20ms
19ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-82nxwLbf6hY/X7tdR2dBoAI/AAAAAAAAApE/_sLSdFJFVG8U60wY4jwHs_5n5aJBf0hLACLcBGAsYHQ/s72-c-e100/waf.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6be8228e7393afe2066e304dac9523f15f3dd70c0979419f55b048102ec3f11

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 13135
cf-polished: origFmt=jpeg, origSize=5547
content-disposition: inline; filename="waf.webp"
vary: Accept, Accept-Encoding
content-length: 5320
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v292"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=AjEfFVqQdFhOJ7Ec8C9YAgsRZ%2BgXhM05yLFT6d2DIci2z3gj%2FCfLbR%2BAorPzA30iD4aPLEyQmX1yGb29RZCQkZkH9FWTlGqqoVKhEnZv0DX%2FXpPrkR5hXAVXE%2Fotfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f77fc700002bd2a2055000000001
accept-ranges: bytes
cf-ray: 5f7cf512d9412bd2-FRA
expires: Fri, 05 Mar 2021 00:01:44 GMT

GET
H2 200 macos.jpg
thehackernews.com/images/-4YByPsCgGOI/X7TkjsGzTZI/AAAAAAAABDY/cnFfTNDAmMMMt9pSbRO8d6iyzn1_8D3ywCLcBGAsYHQ/s72-c-e100/ 3 KB
3 KB 16ms
16ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-4YByPsCgGOI/X7TkjsGzTZI/AAAAAAAABDY/cnFfTNDAmMMMt9pSbRO8d6iyzn1_8D3ywCLcBGAsYHQ/s72-c-e100/macos.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d0426bfe3c597bb040096bf5a75b81cacac24af2c8c591ef82ea71260e201e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2020/11/anyrun-emotet-malware-analysis.html?utm_content=146882017&utm_medium=social&utm_source=twitter&hss_channel=tw-2517162894
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 17:05:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 205010
cf-polished: status=not_needed
content-disposition: inline;filename="macos.jpg"
vary: Accept-Encoding
content-length: 2760
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v437"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GKWYpyFb8Y5sISaTIXSlVOQELJc3qf0aljqTj%2FveyT2PNo%2BNbQLWb%2BnZEHutdr05bo9gKO6%2FSHX7%2BdETCIkHmYykJk%2FG%2Ff8H5q%2FH%2BXXBEVG6GAV59FzpN7DBtLWWbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=8640000, immutable
cf-request-id: 06a1f7804c00002bd29f8d8000000001
accept-ranges: bytes
cf-ray: 5f7cf513ab9f2bd2-FRA
expires: Sun, 28 Feb 2021 02:41:44 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ 42 B
155 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvT7HZd3dW4wY37Z1LJGhy9JHy-7POpu8tt4jke-8zV7PM7nafZAKIktWxclL8VYMUVFRRA2DZnNQ&sig=Cg0ArKJSzAf2PdtWaphOEAE&id=lidar2&mcvt=1001&p=170,436,260,1164&mtos=1001,1001,1001,1001,1019&tos=1001,0,0,0,18&v=20201118&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=34&adk=4037400832&rs=6&met=mue&la=0&cr=0&osd=1&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:05:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI4NDRhZee7QIV5ea7CB1niQDuEAAYACDjmv1C;met=1;&timestamp=1606323964791;eid1=2;ecn1=1;etm1=10;eid2=871060;ecn2=1;etm2=0;
ade.googlesyndication.com/ddm/activity/ 42 B
254 B 57ms
55ms Image
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI4NDRhZee7QIV5ea7CB1niQDuEAAYACDjmv1C;met=1;&timestamp=1606323964791;eid1=2;ecn1=1;etm1=10;eid2=871060;ecn2=1;etm2=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Nov 2020 17:06:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.thehackernews.com/	1970-01-19 14:55:15	Name: __cfduid Value: d11835170fbd58c7e21a92b54837c8f411606323953

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ade.googlesyndication.com
adservice.google.com
adservice.google.de
ajax.cloudflare.com
att.demdex.net
bit.ly
c.amazon-adsystem.com
cdn.adpushup.com
cdnjs.cloudflare.com
d.agkn.com
e3.adpushup.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
s0.2mdn.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
t.co
thehackernews.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
104.244.42.5
172.217.18.162
172.217.22.98
205.234.175.175
216.58.210.6
23.97.225.52
2600:9000:20eb:3400:19:fc2c:a140:93a1
2606:4700:20::681a:61
2606:4700::6810:125e
2606:4700::6810:a823
2a00:1450:4001:81a::2004
2a00:1450:4001:81a::2006
2a00:1450:4001:81c::2002
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::2002
2a00:1450:4001:820::2001
2a00:1450:4001:824::200e
2a00:1450:4001:825::2002
2a00:1450:400c:c0c::9b
52.84.134.201
54.170.224.115
67.199.248.11
009c644478ab408df7eb9043ff663c714c681064ccb1fe56be1e3078f9ce65f7
03007e9dd0b10e60b4c8a4e71496b40dc8026aa60b97c3e54381aa5b2cb39d06
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
1441d1ad3cfe24d4e8146e26cee90908ded2df81328119d5c2bb8a38a52f6ed8
2e527a3483125d104275304b1fe7dcd1e83ac2bbc1ea65a94eea2184e513cdd1
32c80a55d06b9da550f41424241174895bdbe1dd174ee1d015a4d56747cd2a99
3d89310e4beb6184b3f8f1f5eb196d88c1218f3b23af9345278c3c29d7090746
3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff
48d9017b2b7d479fe837cabcdb9ca891f7af55828c84e8b307b9843d45d7a527
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5af1c25ec6f805099823bdf6d255424a9fd5ea7fb97afaa4754cd320de8529a1
5bb0266a4f2d90f99ba4941de76b1ca90fc12ac0e2dd4345a6409d09c61c3733
5d86dac52c474df393d33a1dd373fbedbc3afd632b2d0f79a4d03fdbaa530f27
5ebc145db72bab02fc2b92ca74574394c4076c74605515a04282f1125c2657f9
64d0426bfe3c597bb040096bf5a75b81cacac24af2c8c591ef82ea71260e201e
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
66de80f5c91d14f0c4d222a82eea52a01ab8d8e907f3df2e08a7c4bc1d4ec33d
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c
68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43
6b12bb715457df01fa8b72b9fefc294fec56b5108b37a209788e5621b011b5af
77e533c9ddcf0669d6eb1be6c37dca819419230dce7f3ebdd1c752ad820fed5e
7c6d678bff0699e60890679e43ea69fd33dcee8091528994c2995ef557fe9bcb
805009383730a2d52e65d5a15df0bf9f05b9784a7c3ae0785ca8a461787f846d
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
9370f4d728086e469b91e50321a7892aa3272e5c9d14787ce8fad1d6848e7395
a1d4010571ffd2f95866503d163abc2a0e0c8fb3d3f540fb112fe0ecfbaae3dd
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a
abaf592391fb0a053a8706690458ca1b77f6502595b88c3d34feb040cf66dee6
ad7386d16a056df5c235702a97a5fa4cee68e302d71041aa35df96151f756f48
ae9daae5c7e9177b48cf7e63c72537535d98efdf02ed86021f4c780975ba57a8
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afb01d2aa20ad23da0238c979259816feb72ff155e7649c4edebd4ca741964ed
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b6be8228e7393afe2066e304dac9523f15f3dd70c0979419f55b048102ec3f11
bb10cecea4a21be92d92b0564c43ddebff5ae08de856f557bbb0b6e3c6881a62
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a
ca85db932ecb7fd8d5fdd101ac11e815bec5cfc59f74220d9af2c2d01069ab80
d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5
e37a0a73d3775b46a4d266f090ff2fc52a3243a8645dc765d8481cd0e2f56997
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f03c3526dd6db1c340c972db0194f8b732611626e1bcde62426d70a68c7a023b
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02
fa3748e2366d5ba5f4a7b6c8154809725b6bfb7843743837384c70f060b33503
fe94fcc14c2b9f93c39cbe038796bff0ebc07a140ebd15e66b3a897b6a25bc82

thehackernews.com Open in urlscan Pro 2606:4700:20::681a:61 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

60 Requests

100 %HTTPS

59 %IPv6

16 Domains

26 Subdomains

21 IPs

5 Countries

1313 kBTransfer

2788 kBSize

1 Cookies

37 Outgoing links

Page URL History

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

100 %
HTTPS

59 %
IPv6

16
Domains

26
Subdomains

21
IPs

5
Countries

1313 kB
Transfer

2788 kB
Size

1
Cookies

60 HTTP transactions
9 data transactions