www.zdnet.com Open in urlscan Pro
2.21.36.253 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Submission: On September 13 via api (September 13th 2019, 12:01:18 pm UTC) from US

Summary HTTP 419 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 65 IPs in 7 countries across 59 domains to perform 419 HTTP transactions. The main IP is 2.21.36.253, located in France and belongs to AKAMAI-ASN1, US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2.21.36.253 2.21.36.253	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
56	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY - Fastly)
22	2a04:4e42:3::444 2a04:4e42:3::444	54113 (FASTLY) (FASTLY - Fastly)
1	184.30.221.201 184.30.221.201	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
7	104.108.48.32 104.108.48.32	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
20	2a00:1450:400... 2a00:1450:4001:81b::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.35.253.65 13.35.253.65	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	54.210.129.141 54.210.129.141	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE - Google LLC)
1	54.77.88.162 54.77.88.162	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 21	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
20	216.58.210.2 216.58.210.2	15169 (GOOGLE) (GOOGLE - Google LLC)
14	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff11	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
5	2606:4700::68... 2606:4700::6810:a30d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
9	2606:4700::68... 2606:4700::6810:50a5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4 16	34.248.158.173 34.248.158.173	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	64.30.230.22 64.30.230.22	6623 (CBSI-1) (CBSI-1 - CBS Interactive Inc.)
3	184.31.90.90 184.31.90.90	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2606:4700:20:... 2606:4700:20::6819:a322	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	34.233.109.111 34.233.109.111	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 2	104.108.34.58 104.108.34.58	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4 4	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE - Google LLC)
4 4	2.21.37.45 2.21.37.45	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4 4	54.76.84.205 54.76.84.205	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4 6	18.197.149.199 18.197.149.199	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 8	34.247.192.223 34.247.192.223	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	151.101.114.133 151.101.114.133	54113 (FASTLY) (FASTLY - Fastly)
1	2600:9000:20b... 2600:9000:20bb:2200:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	107.23.96.251 107.23.96.251	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
4	99.80.15.126 99.80.15.126	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	34.237.94.5 34.237.94.5	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
5	185.33.223.209 185.33.223.209	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1 4	66.117.28.68 66.117.28.68	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
2 2	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
2 2	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:80b::2006	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1 4	54.194.74.162 54.194.74.162	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2600:9000:205... 2600:9000:2057:d600:1d:8c8c:47c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 8	184.25.159.208 184.25.159.208	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	23.99.128.52 23.99.128.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	35.227.208.151 35.227.208.151	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:4001:81f::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2001:4998:58:... 2001:4998:58:4904::7000	26101 (YAHOO-3) (YAHOO-3 - Oath Holdings Inc.)
1	35.157.160.140 35.157.160.140	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
5	2600:9000:205... 2600:9000:2057:6800:2:42d9:3100:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
31	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
5	2.19.38.84 2.19.38.84	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.18.233.143 2.18.233.143	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
5	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
3	18.130.114.178 18.130.114.178	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
14	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
5	69.173.144.152 69.173.144.152	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
2	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
5	104.109.78.125 104.109.78.125	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42:3::621 2a04:4e42:3::621	54113 (FASTLY) (FASTLY - Fastly)
2	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2607:f8b0:400... 2607:f8b0:4005:802::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	107.23.109.48 107.23.109.48	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2.16.186.88 2.16.186.88	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	52.44.156.47 52.44.156.47	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
25	151.101.114.2 151.101.114.2	54113 (FASTLY) (FASTLY - Fastly)
4	151.101.13.181 151.101.13.181	54113 (FASTLY) (FASTLY - Fastly)
7	2.16.186.72 2.16.186.72	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
419	65

10 2.21.36.253 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-36-253.deploy.static.akamaitechnologies.com

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a04:4e42:3::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.221.201 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-221-201.deploy.static.akamaitechnologies.com

c.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.108.48.32 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-48-32.deploy.static.akamaitechnologies.com

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0211c83e.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
686eb51b.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:81b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.65 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-65.fra6.r.cloudfront.net

native.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.210.129.141 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-210-129-141.compute-1.amazonaws.com

l.betrad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.198 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s08-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.88.162 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-77-88-162.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 152.199.23.241 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff11 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

iicbsi-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:a30d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:50a5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api1.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 34.248.158.173 (Dublin, Ireland) 4 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 64.30.230.22 (Fremont, United States)

ASN6623 (CBSI-1 - CBS Interactive Inc., US)
PTR: phx2-dw-cbsi-xw-ext-lb.cnet.com

dw.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.31.90.90 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-90-90.deploy.static.akamaitechnologies.com

www.everestjs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::6819:a322 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
beacon.tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.233.109.111 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-233-109-111.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.108.34.58 (Netherlands) 2 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-34-58.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.72.21 (Mountain View, United States) 4 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.21.37.45 (France) 4 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-37-45.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.76.84.205 (Dublin, Ireland) 4 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-84-205.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.197.149.199 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.247.192.223 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cbsi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20bb:2200:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 107.23.96.251 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-107-23-96-251.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.80.15.126 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com

api.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.237.94.5 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-237-94-5.compute-1.amazonaws.com

saa.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.223.209 (Netherlands)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 66.117.28.68 (United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.117.28.86 (United States) 2 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.207.66 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.194.74.162 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-194-74-162.eu-west-1.compute.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:d600:1d:8c8c:47c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn-magiclinks.trackonomics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 184.25.159.208 (Netherlands) 2 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-159-208.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.209.240 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.99.128.52 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: waws-prod-dm1-001.cloudapp.net

lightboxapi2.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.208.151 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 151.208.227.35.bc.googleusercontent.com

web-sdk.urbanairship.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:58:4904::7000 (United States)

ASN26101 (YAHOO-3 - Oath Holdings Inc., US)

ad.yieldmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.160.140 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-157-160-140.eu-central-1.compute.amazonaws.com

www.summerhamster.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2057:6800:2:42d9:3100:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cbsdfp5832910442.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.19.38.84 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-38-84.deploy.static.akamaitechnologies.com

ads.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.143 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-143.deploy.static.akamaitechnologies.com

rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

optimized-by.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.130.114.178 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-130-114-178.eu-west-2.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.152 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

beacon-eu2.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.109.78.125 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4005:802::2003 (United States)

ASN15169 (GOOGLE - Google LLC, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.23.109.48 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-107-23-109-48.compute-1.amazonaws.com

inqlnfvog763mmf771rou737u.litix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.88 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-88.deploy.static.akamaitechnologies.com

cbsadsales-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.44.156.47 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-44-156-47.compute-1.amazonaws.com

cbsinteractive.hb.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.13.181 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

widget.perfectmarket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.16.186.72 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-72.deploy.static.akamaitechnologies.com

techrepublicmedia.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
78	cbsistatic.com zdnet1.cbsistatic.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com zdnet4.cbsistatic.com	952 KB
29	doubleclick.net 2 redirects ad.doubleclick.net securepubads.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	233 KB
25	taboola.com cdn.taboola.com trc.taboola.com images.taboola.com	372 KB
20	rubiconproject.com ads.rubiconproject.com optimized-by.rubiconproject.com beacon-eu2.rubiconproject.com eus.rubiconproject.com	46 KB
20	googletagservices.com www.googletagservices.com	528 KB
19	moatpixel.com cbsdfp5832910442.s.moatpixel.com	8 KB
18	ml314.com 4 redirects ml314.com in.ml314.com	32 KB
15	moatads.com z.moatads.com geo.moatads.com px.moatads.com	1 MB
14	googlesyndication.com tpc.googlesyndication.com Failed pagead2.googlesyndication.com	702 KB
14	tiqcdn.com tags.tiqcdn.com	89 KB
12	cbsi.com dw.cbsi.com saa.cbsi.com rev.cbsi.com	16 KB
11	zdnet.com www.zdnet.com urs.zdnet.com	208 KB
9	imrworldwide.com 1 redirects secure-us.imrworldwide.com cdn-gl.imrworldwide.com	61 KB
9	lightboxcdn.com www.lightboxcdn.com api1.lightboxcdn.com	160 KB
9	viglink.com cdn.viglink.com api.viglink.com	85 KB
8	gstatic.com fonts.gstatic.com csi.gstatic.com	27 KB
8	scorecardresearch.com 2 redirects sb.scorecardresearch.com	5 KB
8	demdex.net 1 redirects dpm.demdex.net cbsi.demdex.net	7 KB
8	google.com 1 redirects adservice.google.com www.google.com	1 KB
8	google.de adservice.google.de www.google.de	1 KB
7	akamaized.net techrepublicmedia.akamaized.net	6 MB
7	cbsinteractive.com vidtech.cbsinteractive.com	445 KB
6	everesttech.net 3 redirects pixel.everesttech.net cm.everesttech.net	3 KB
6	chartbeat.net ping.chartbeat.net	1008 B
6	eyeota.net 4 redirects ps.eyeota.net	3 KB
5	adnxs.com secure.adnxs.com	6 KB
4	perfectmarket.com widget.perfectmarket.com	94 KB
4	omtrdc.net cbsinteractive.hb.omtrdc.net	1 KB
4	crwdcntrl.net 4 redirects sync.crwdcntrl.net	3 KB
4	mathtag.com 4 redirects pixel.mathtag.com	3 KB
4	rlcdn.com 4 redirects idsync.rlcdn.com	1 KB
4	go-mpulse.net c.go-mpulse.net	58 KB
3	facebook.net connect.facebook.net	120 KB
3	akstat.io 0211c83e.akstat.io 686eb51b.akstat.io	1 KB
3	tru.am tru.am beacon.tru.am	14 KB
3	everestjs.net www.everestjs.net	8 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	litix.io inqlnfvog763mmf771rou737u.litix.io	698 B
2	googleapis.com imasdk.googleapis.com fonts.googleapis.com	487 B
2	facebook.com www.facebook.com	324 B
2	2mdn.net s0.2mdn.net	97 KB
2	casalemedia.com as-sec.casalemedia.com	1 KB
2	bluekai.com 2 redirects tags.bluekai.com	2 KB
2	akamaihd.net iicbsi-a.akamaihd.net cbsadsales-a.akamaihd.net	456 B
2	betrad.com l.betrad.com	240 B
1	jsdelivr.net cdn.jsdelivr.net	2 KB
1	summerhamster.com www.summerhamster.com	181 B
1	yieldmanager.com ad.yieldmanager.com	341 B
1	googleadservices.com 1 redirects www.googleadservices.com	384 B
1	urbanairship.com web-sdk.urbanairship.com	17 KB
1	azurewebsites.net lightboxapi2.azurewebsites.net	510 B
1	qualtrics.com zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	15 KB
1	trackonomics.net cdn-magiclinks.trackonomics.net	18 KB
1	chartbeat.com static.chartbeat.com	23 KB
1	adsrvr.org match.adsrvr.org	536 B
1	sharethrough.com native.sharethrough.com	117 KB
1	indexww.com js-sec.indexww.com	26 KB
1	evidon.com c.evidon.com	431 B
0	disqus.com Failed zdnet-1.disqus.com Failed
419	59

	Domain	Requested by
27	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
22	zdnet2.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
20	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.zdnet.com
20	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com pagead2.googlesyndication.com
19	cbsdfp5832910442.s.moatpixel.com
18	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
16	images.taboola.com	z.moatads.com www.googletagservices.com
16	ml314.com	4 redirects tags.tiqcdn.com ml314.com www.zdnet.com z.moatads.com
14	pagead2.googlesyndication.com	optimized-by.rubiconproject.com pagead2.googlesyndication.com
14	tags.tiqcdn.com	zdnet2.cbsistatic.com tags.tiqcdn.com
11	z.moatads.com	securepubads.g.doubleclick.net
11	zdnet1.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
10	www.zdnet.com	zdnet3.cbsistatic.com vidtech.cbsinteractive.com
8	sb.scorecardresearch.com	2 redirects tags.tiqcdn.com cdn.taboola.com widget.perfectmarket.com
8	www.lightboxcdn.com	www.zdnet.com www.lightboxcdn.com
7	techrepublicmedia.akamaized.net	vidtech.cbsinteractive.com
7	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com
7	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com vidtech.cbsinteractive.com
7	adservice.google.com	www.googletagservices.com pagead2.googlesyndication.com
7	adservice.google.de	www.googletagservices.com pagead2.googlesyndication.com
6	csi.gstatic.com	securepubads.g.doubleclick.net s0.2mdn.net
6	saa.cbsi.com	tags.tiqcdn.com vidtech.cbsinteractive.com
6	ping.chartbeat.net	www.zdnet.com
6	dpm.demdex.net	1 redirects www.zdnet.com tags.tiqcdn.com vidtech.cbsinteractive.com
6	ps.eyeota.net	4 redirects www.zdnet.com
5	trc.taboola.com	cdn.taboola.com
5	eus.rubiconproject.com	www.zdnet.com
5	beacon-eu2.rubiconproject.com	www.zdnet.com
5	optimized-by.rubiconproject.com	ads.rubiconproject.com
5	ads.rubiconproject.com	www.zdnet.com
5	cdn-gl.imrworldwide.com	vidtech.cbsinteractive.com cdn-gl.imrworldwide.com
5	secure.adnxs.com	js-sec.indexww.com
5	dw.cbsi.com	tags.tiqcdn.com www.zdnet.com
5	cdn.viglink.com	tags.tiqcdn.com www.zdnet.com
4	widget.perfectmarket.com	cdn.taboola.com widget.perfectmarket.com
4	cdn.taboola.com	zdnet2.cbsistatic.com cdn.taboola.com
4	cbsinteractive.hb.omtrdc.net	vidtech.cbsinteractive.com
4	secure-us.imrworldwide.com	1 redirects
4	pixel.everesttech.net	1 redirects
4	api.viglink.com	cdn.viglink.com
4	sync.crwdcntrl.net	4 redirects
4	pixel.mathtag.com	4 redirects
4	idsync.rlcdn.com	4 redirects
4	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
3	geo.moatads.com	z.moatads.com
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
3	www.everestjs.net	tags.tiqcdn.com www.everestjs.net
2	www.google-analytics.com	widget.perfectmarket.com
2	inqlnfvog763mmf771rou737u.litix.io	vidtech.cbsinteractive.com
2	fonts.gstatic.com	z.moatads.com
2	686eb51b.akstat.io	c.go-mpulse.net zdnet1.cbsistatic.com
2	www.facebook.com	connect.facebook.net
2	s0.2mdn.net	zdnet2.cbsistatic.com s0.2mdn.net
2	cm.everesttech.net	2 redirects
2	as-sec.casalemedia.com	js-sec.indexww.com
2	cbsi.demdex.net	tags.tiqcdn.com
2	tags.bluekai.com	2 redirects
2	in.ml314.com	ml314.com
2	tru.am	tags.tiqcdn.com tru.am
2	l.betrad.com	www.zdnet.com
1	cbsadsales-a.akamaihd.net
1	cdn.jsdelivr.net	www.lightboxcdn.com
1	fonts.googleapis.com	www.lightboxcdn.com
1	imasdk.googleapis.com	s0.2mdn.net
1	px.moatads.com
1	rev.cbsi.com	www.zdnet.com
1	www.summerhamster.com
1	ad.yieldmanager.com
1	www.google.de
1	www.google.com	1 redirects
1	www.googleadservices.com	1 redirects
1	web-sdk.urbanairship.com	zdnet3.cbsistatic.com
1	api1.lightboxcdn.com	www.lightboxcdn.com
1	lightboxapi2.azurewebsites.net	www.lightboxcdn.com
1	zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	tags.tiqcdn.com
1	cdn-magiclinks.trackonomics.net	tags.tiqcdn.com
1	cm.g.doubleclick.net	1 redirects
1	0211c83e.akstat.io	zdnet1.cbsistatic.com
1	beacon.tru.am	tru.am
1	static.chartbeat.com	zdnet2.cbsistatic.com
1	iicbsi-a.akamaihd.net	tags.tiqcdn.com
1	match.adsrvr.org	js-sec.indexww.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	ad.doubleclick.net	www.zdnet.com
1	native.sharethrough.com	www.zdnet.com
1	js-sec.indexww.com	www.zdnet.com
1	c.evidon.com	www.zdnet.com
0	zdnet-1.disqus.com Failed	zdnet2.cbsistatic.com
0	tpc.googlesyndication.com Failed	securepubads.g.doubleclick.net
419	89

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
www.welivesecurity.com
www.cnet.com
popup.taboola.com
trf.greatviews.de
www.gutes-hoeren.de
om.elvenar.com
www.aroundhome.de
www.hausverkaufshelfer.de
shopviu.com
www.mdm.de
www.austria.info
cbsi.force.com
www.cbsinteractive.com
cbsi.secure.force.com
cbslnk.cbsileads.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
legalterms.cbsinteractive.com
narratives.zdnet.com
academy.zdnet.com

Subject Issuer	Validity	Valid
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
*.evidon.com DigiCert ECC Secure Server CA	`2019-02-01` - `2020-05-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh
*.sharethrough.com Go Daddy Secure Certificate Authority - G2	`2018-09-18` - `2019-11-17`	a year	crt.sh
l.betrad.com Go Daddy Secure Certificate Authority - G2	`2019-04-25` - `2021-06-24`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2017-12-12` - `2020-12-15`	3 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2020-05-13`	3 years	crt.sh
a248.e.akamai.net DigiCert ECC Secure Server CA	`2018-10-18` - `2019-10-18`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-10` - `2020-02-16`	6 months	crt.sh
ssl516460.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-24` - `2020-03-01`	6 months	crt.sh
*.ml314.com Amazon	`2019-03-16` - `2020-04-16`	a year	crt.sh
*.cbsi.com DigiCert SHA2 High Assurance Server CA	`2017-11-07` - `2021-02-04`	3 years	crt.sh
www.everestjs.net DigiCert SHA2 Secure Server CA	`2018-10-15` - `2020-10-15`	2 years	crt.sh
ssl389962.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-09-11` - `2020-03-19`	6 months	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2019-07-11` - `2019-10-09`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2018-12-20` - `2020-01-01`	a year	crt.sh
viglink.com Amazon	`2019-02-09` - `2020-03-09`	a year	crt.sh
saa.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-06-23` - `2020-09-25`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.everesttech.net DigiCert SHA2 Secure Server CA	`2017-04-13` - `2020-04-17`	3 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-08-24` - `2019-10-19`	2 months	crt.sh
*.imrworldwide.com DigiCert SHA2 Secure Server CA	`2019-02-25` - `2020-02-25`	a year	crt.sh
*.trackonomics.net Go Daddy Secure Certificate Authority - G2	`2018-12-22` - `2020-02-20`	a year	crt.sh
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA	`2018-11-28` - `2019-12-26`	a year	crt.sh
*.qualtrics.com DigiCert SHA2 Secure Server CA	`2018-10-08` - `2021-01-06`	2 years	crt.sh
*.azurewebsites.net DigiCert SHA2 Secure Server CA	`2019-07-22` - `2021-07-22`	2 years	crt.sh
*.urbanairship.com DigiCert ECC Secure Server CA	`2018-06-20` - `2020-06-24`	2 years	crt.sh
www.google.de GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2019-06-27` - `2019-12-24`	6 months	crt.sh
*.summerhamster.com Let's Encrypt Authority X3	`2019-07-23` - `2019-10-21`	3 months	crt.sh
moatads.com DigiCert ECC Secure Server CA	`2018-11-10` - `2020-02-09`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-02-13` - `2021-02-17`	2 years	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
*.googleapis.com GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-29` - `2020-04-23`	a year	crt.sh
*.litix.io Amazon	`2019-01-22` - `2020-02-22`	a year	crt.sh
*.hb.omtrdc.net DigiCert SHA2 Secure Server CA	`2017-12-22` - `2020-01-03`	2 years	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-07-30` - `2020-07-25`	a year	crt.sh
p.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-09-03` - `2021-02-22`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh

This page contains 37 frames:

Primary Page: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Frame ID: 3F4CD1E36B9C1C7C8EA6C1B51D850680
Requests: 296 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: F9B1CCD72846436CCA4DF0F906C3E1D9
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568376061458&lv=1
Frame ID: 5FD74C6F8A275CD4EB3A0CB6273D19D3
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637039077227986622
Frame ID: 572B69E32AF9F54FB17AEABCEDA4A69A
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: C4CB84BCD489DA463348B6FEA6635CA4
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 08422FBB75CBA85CBABCAFD3CE0E37E7
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 86CA3E53F217025FEC107FCA4DF8DCF7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstKeBFTdNj9SizpxjFxdZ71QX0ltikB3y_gH00lNZTth4r0O_09FjDMH9llAyqdTQnUqT5gqyLJbF3fZKtfMyjDkx4sa_deVg3OwyJUm0qL2KvZdckMrcAkX1Bx5x7tqfabhxE89xl0oyjefKrc7IppWRIrc73b18dKF29nqrexFLkJUYywWW8ebQGDTKOZO-nDAP0I3Wsa9J855fhDl-dG3jYaPCom9CxQKquXF9Kw5EuLNbqnRs1vti24IXqpKktGT0trKZlS&sig=Cg0ArKJSzG5HPcKSsr4XEAE&urlfix=1&adurl=
Frame ID: 22165E3E8F230BDFB063CBFAF0378E46
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPgy-Uj-CYTATVkexvxxxDcYaTb5oKVCqyTxcoENHBU9WueKzlVU1_mNQpWOAeqAvIeTZjIMZhxkMMupgmPbgylp7JfFSt44TOfjTsmewhXdAn1AdJJHa1Bz3XPGnoldi_NK067HrkdAL42R5M8dp0IEcK_NShdYG-eL1ocJWKTeQuGeNtvFaXxI-1nInJUzgSdU-D7iWk0zktsDUoVgM_RBQSfhYo-93elSze_3M2gmIp3RH_-Punqw5l5vA0ppyO5nA&sig=Cg0ArKJSzLKun1Srg7npEAE&urlfix=1&adurl=
Frame ID: 711EDCF4A161EA22714A0EE2155DB816
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmQjCiXSrMkHj2OIUMPz-3c5iRtKCx2oBjjIlMQAY1S1gM3NJksHSCrTVzuvCJFbuKdHAyXfwFZYUNtLMSOpiM7UzSBvDcQEJNk1GVKm00Cyo0nf0By7eE5GClwFTaFC8a_jX98WuECOykOr7KH1rUT_aS8y36v68lTQmplscNfYs7jgaQy62P3M1P_X7ib45Lb05CzGIL9EiGkoHbxFe9K3JP3a1CvhJtCeQKpu0rsv3gVd9vw3xLFkRCXtsM7KG9FzI&sig=Cg0ArKJSzO0lC7X2p9N3EAE&urlfix=1&adurl=
Frame ID: 10C40D4011A23554C0CECBA34B0B31FB
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJGDw4QLOheINHn7ESxv-KLAVjVqdxYvLE_U4h19B36Qfh1w2q_iuiLO--yf-lRe8yfpeHC31c1aUT8QDGAiG25qos1QZbZKN0ZE6UY5g8AAeE6npz6as2JL5srnFy9RFQh4wUfkUq5DULL4tsru7ksULagSJF5nOejzVfggEYRDYppVxGyy7461vev3RY8YPkaJXDWf40cHZOIUE9RWwANweOu4IpMFwZHn0pS43g41ZlMgSBnxjpIoB2_ewCoFlhap4&sig=Cg0ArKJSzH_jT7x95vhYEAE&urlfix=1&adurl=
Frame ID: E8E5C43957A2C0C9082B392CAF09530D
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsualaDVBwJoa2LMqUu7kAvX-kDBhSzk7lUAQbFgIcnrvWGbBolan1wI_B5dg6l4YWHbu4XbetQwQyJhkJiy4ZsEZJUXKNJAQsbmMNOOgqeyV9HB0T-EO2Y8qs9t0d5vGbcLUkr0pSxk0GOSNYj_0y7l4g216ZkP18HT--yP3J5n6Hd6bMFpsJ19xuznZWvtEe6lpwBNcjRYcmMSSW7N4FegUkzm-ASi4IiQyK9bkPWQ3OSP9UO5N2iAsuofFvLYpxsosYA&sig=Cg0ArKJSzIIZLiMybEGDEAE&urlfix=1&adurl=
Frame ID: 459B627FE023EA6BABA00A76EAD18E94
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOCS3EBxjLuNF-3dResROPrw6rzxNB4HPAbqUHewPhG1yDzRp84EmX1HcCdGsQpHY7qPVNSQig9mF-zRDUDXYQbMH5rhQRODqe1bGzVrKHRx0GcKpfLTrrOY1PP_oM-oxtpd_T5FaIXTPiQ4fPfIMnzqD3bA3wNI1CAOLDwSFCddSl9vOtLXafsYOU5dos_w8w80-nV4ahTasdn5oMptPEXt0kx9Vor3R5JvZpxpjLf6mr9LaO4nQYyyS4U4q25obiT1I&sig=Cg0ArKJSzHgRL_UXkrU3EAE&urlfix=1&adurl=
Frame ID: 28911446146D62F1110149530A6E0342
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuRm6VyNgH5IvOQshAxkg4bsbRPOtyOh9CLIgGZY-fIbg_srcCgXjboIEWB3tSKH8Nr1OTwa7w0f24CVKMW04BXKv7e5jq8z87hpZZvP8j-hnmhxSjNuMSFAYfIeYF1xbMHRkDvHtwSPXBHNyYgyQg_tjLOS2Re6vljKpxbDjxudPohzALUgOE8LM4syooOAYjIOAASAUw7lHN_4-WckL05K6sU0jRqg_QVv_Ph7X2ujZxHBOWfstmPxsX0HEUtIRK_-UnMpvZU&sig=Cg0ArKJSzMnj1n4hP-fkEAE&urlfix=1&adurl=
Frame ID: 9F8D186B92278433D4AFF2AE353B2890
Requests: 13 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637039077227986622
Frame ID: 42751C3EAD81C024056743F886623F97
Requests: 4 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4D0B7ABE74A67DF06CC9EDA5F7D455E4
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.330.0_en.html
Frame ID: 81D5E75F3656858C184E8DEC603F225F
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Frame ID: 7F3E17BD9ECE2EC0E61E5CD0EAAF243C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/zrt_lookup.html
Frame ID: EE30288F0156A05BFA8576704CE91237
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 893BF5768B19A72265DF6BE9D2D347A4
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: B644B4BB435F4DEC06145578BCEDB000
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 2C66D192B92EF3E5410AD3FBDAAB1B4E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Frame ID: 8874D397925B79D3129DD1D37514F357
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 55C6C6D1B3ADF692BF10C0ADE2923A6B
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 4FBC2A48DB36816B748D97BED9C5E47B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064167&bpp=36&bdt=710&fdt=791&idt=791&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&rume=1&frm=23&ife=5&pv=2&ga_vid=1508440188.1568376065&ga_sid=1568376065&ga_hid=2003191431&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2430&biw=1585&bih=1200&isw=300&ish=250&ifk=3748784076&scr_x=0&scr_y=0&eid=21060549&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.2u5sgg4f69uz&fsb=1&dtd=821
Frame ID: 83CB53D1D9BE376BF145B39EE5BE4BB0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162154&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064206&bpp=50&bdt=818&fdt=817&idt=817&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=168651392.1568376065&ga_sid=1568376065&ga_hid=289900991&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=3566962586&scr_x=0&scr_y=0&eid=20199335&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.f4jvwiiicb6j&fsb=1&dtd=823
Frame ID: 842B048BA5170CC8AAF30FEE8D771CA2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224024&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064262&bpp=19&bdt=782&fdt=773&idt=773&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=94586948.1568376065&ga_sid=1568376065&ga_hid=1789786944&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3426&biw=1585&bih=1200&isw=728&ish=90&ifk=80841140&scr_x=0&scr_y=0&eid=20199335%2C368226500&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.kvzuq9qyzvlz&fsb=1&dtd=780
Frame ID: 92996696BEAB5BC1506376753FD5BFED
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162155&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064287&bpp=42&bdt=914&fdt=790&idt=790&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=1440463021.1568376065&ga_sid=1568376065&ga_hid=925113771&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1007310051&scr_x=0&scr_y=0&eid=20199336%2C20040010&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.7xwvs5foo9qk&fsb=1&dtd=799
Frame ID: 884C311FEFC1D2055570B71371778B4B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064351&bpp=14&bdt=955&fdt=818&idt=818&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=75661714.1568376065&ga_sid=1568376065&ga_hid=1521471590&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1455&biw=1585&bih=1200&isw=300&ish=250&ifk=3638436589&scr_x=0&scr_y=0&eid=20199335%2C21064339&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.y1sok0efbdnt&fsb=1&dtd=827
Frame ID: 104311C2B76BC142D7E78B207A879410
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst4LliQjREH13lGjnhtf64sttNUv6xWkxND33hmwNShUVuXpYsDeAvIQrVlJUKh5AJdCXANnF3o0L81EZkHGOCCxia1uniETWMUGxQH7NmWSYuzM5t_aRzhLNBbLvnpJJW5TF0gGr2ubbrhcWYO6VxP-HsXvHvXX-89Iri3JfSSjMyZ2iXS3MowFkuvuaeN05wZqLi7Qo28f5X9wXURwnfu-0ZmVXi96PPudfCp9GTlIO0pVNjePPFpebRa00eEOYL3dLsrciBo&sig=Cg0ArKJSzINw8ePVp70vEAE&urlfix=1&adurl=
Frame ID: BBC2891CBFF16442CA9305BC2FE66B4E
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstS8uxuwcQ_OUPn5Pjqw20qNE3mT2OSrEhIqreGqrSdLPIKKYgz9ygscw5ztGgxcZxAwIJjSzcxFhGV6zrtRg9wdx5uOdeAW6Q4TppqW4EDGsoWkAA87o6yc7hBBMdotY7HYBBHoTTYWicKuktkvosVGDTUDpScvXVP-bH0DaNO-6o_nRNvXcjiIv5QS4fYdBR45_nE0ek2ZAwUPmiB6vjTVQVvh42-PKDtHf6YjeQnldV6ij0L2zch43FIKEcn2qcsjS8xJ6A4&sig=Cg0ArKJSzDp8Q1ATRhwuEAE&urlfix=1&adurl=
Frame ID: 5E85936DB3FBD45073B3055D08749436
Requests: 5 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 7E0D5733BD456ECAE4B771BE8FF4351A
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuB147NCnonnw1lZo1abEWt4kdkqKvOqqtnEgEs1KSNPKrGRQWsHMghr3zAOP_o-CvitjpfzF-ZrKCHSUDm8Iexk-i8HMk2TqwXylNy5hRwHAAJW-eDfxDeIGqxQU2fMF7AuYzOJPJ7bybB2Eqt4o7j4SfGuFE-WHGGzqEPF02p-B3nLctUxklp0jPjGVI5LaZ0o_viEZfuj5PbY1L1O6bL26JbszImZgyWmvixUitSjsq96_p_cURfvayV9JXi6QIT7ZAYVzZH&sig=Cg0ArKJSzJKP0U5V4dgXEAE&urlfix=1&adurl=
Frame ID: AE53C53FB7B1569A668FE317C50E2DCF
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv1ooUk5rcNR2Oyz3S0RXSupP5OYBebr-jvS2VWepVcLcQTkor8O0yVrJrc6gSWMPr795Dq3mD--UziV6ZdfUQKpu2Oxr212Tzdkam7m5JKIxDY1kCShz8v3V-we4taNHqtYlFncWS2Qqo_HpufrRge6EmNOiwnMBWRSd-bB3RSlFGfW1826mFVanp_Ox_NDKKgYrdVMSnUehw-blNEkquE9NDI4m5w0AYko4p99lHaxweCYGnKssSv6n1NLQK1iYOL7-yJJPbh&sig=Cg0ArKJSzJigf6Tow7jPEAE&urlfix=1&adurl=
Frame ID: E265E31C4307BB6C506395DD8D97A5B7
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: A747E6FF158BE8184F1E342665068794
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: A347FD03FD80A6891FC675FB174131E7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /2mdn\.net/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /2mdn\.net/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

VigLink (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:^[^\/]*\/\/[^\/]*viglink\.com\/api\/|vglnk\.js)/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

419
Requests

99 %
HTTPS

32 %
IPv6

59
Domains

89
Subdomains

65
IPs

7
Countries

11540 kB
Transfer

22666 kB
Size

28
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/10-dangerous-app-vulnerabilities-to-watch-out-for-free-pdf/?ftag=CMG-01-10aaa1b
Title: 10 dangerous app vulnerabilities to watch out for (free PDF)

Search URL Search Domain Scan URL

URL: https://www.welivesecurity.com/2019/08/08/varenyky-spambot-campaigns-france/
Title: the ESET Varenyky report

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/cybersecurity-malware-lingers-in-smbs-for-an-average-of-800-days-before-discovery/?ftag=CMG-01-10aaa1b
Title: Malware lingers in SMBs for an average of 800 days before discovery

Search URL Search Domain Scan URL

URL: https://www.cnet.com/news/us-mayors-adopt-resolution-to-not-pay-hackers-over-ransomware-attacks/?ftag=CMG-01-10aaa1b
Title: US mayors resolve not to pay hackers over ransomware attacks

Search URL Search Domain Scan URL

URL: https://popup.taboola.com/en/?template=colorbox&utm_source=cbsinteractive-zdnet&utm_medium=referral&utm_content=alternating-thumbnails-a:ZDNETarticleDesktop/Tablet-Below%20Article%20Thumbnails:
Title: by Taboola

Search URL Search Domain Scan URL

URL: https://trf.greatviews.de/cl?m315=c&q=UuUhGp3Jm7uQbNkxXx5Lkkjg&pscode=01_100_42648_1020_2187_0007_00_AFsite_cbsinteractive-zdnet_cid_209251377ID_GV00ID
Title: Parship

Search URL Search Domain Scan URL

URL: https://www.gutes-hoeren.de/kostenlos-probieren?utm_campaign=GH_ctest_kostenlos-probieren-taboola-native_Desktop&utm_content=275636737&utm_source=taboola&utm_medium=native&utm_publisher_id=cbsinteractive-zdnet
Title: Gutes-Hoeren.de

Search URL Search Domain Scan URL

URL: https://om.elvenar.com/ox/de/?ref=tab_de_dach&&external_param=25818511&pid=cbsinteractive-zdnet&bid=25818511
Title: Elvenar - Free Online Game

Search URL Search Domain Scan URL

URL: https://www.aroundhome.de/immobilienverkauf/gruender/?utm_content=20190618_hausverkauf_2deutsche_gruender_20&prid=566&plmt=cbsinteractive-zdnet&utm_term=1039694&click_id=CjBhODY3MzYwMi0zYjE1LTRjMmYtOWJiNy00NTY0YTQ3NzE4YjktdHVjdDQ3NTBhODMSH2Fyb3VuZGhvbWUtaW1tb2JpbGllbnZlcmthdWYtc2M&meco=de&utm_medium=dis_pn&utm_source=taboola&utm_campaign=immobilienverkauf-taboola-desktop-180619%7C566-dis_pn-de-5
Title: Aroundhome

Search URL Search Domain Scan URL

URL: https://www.hausverkaufshelfer.de/tb/?utm_medium=dis_pn&utm_source=taboola&utm_campaign=40C-taboola-immobilienverkauf-desktop&utm_content=274851211&utm_term=cbsinteractive-zdnet&tbid=CjBhODY3MzYwMi0zYjE1LTRjMmYtOWJiNy00NTY0YTQ3NzE4YjktdHVjdDQ3NTBhODMSK3NjaHVia3JhZnRkaWdpdGFsZ21iaC1oYXVzdmVya2F1ZnNoZWxmZXItc2M
Title: HausverkaufsHelfer.de

Search URL Search Domain Scan URL

URL: https://shopviu.com/de_de/brillen/zuhause-anprobieren?utm_source=taboola&utm_medium=cpc&utm_campaign=DE_TAH_Desktop
Title: VIU Eyewear

Search URL Search Domain Scan URL

URL: https://www.mdm.de/dop?sku=P_TNT_2_E0091&wk=1819905&campaign=Dis/taboola/1819905&utm_source=taboola&utm_medium=display&utm_campaign=sk&utm_source=taboola&utm_medium=referral
Title: MDM

Search URL Search Domain Scan URL

URL: https://www.austria.info/de/aktivitaten/radfahren/rad-urlaub-in-osterreich/genussradfahren/neusiedler-see-radweg?utm_source=taboola&utm_medium=cbsinteractive-zdnet&utm_campaign=BER1902002_tk_rad_genuss_r0702&utm_content=r0702-B
Title: austria.info

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/Privacy-Policy?categories=CBS_Interactive%3AmPrivacy&template=template_mobilePrivacy&referer=mobileprivacy.com&data=&cfs=default
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/mThird-Party-Social-Networking-Services?template=template_mobilepp&referer=mobilepp.com&data=&cfs=default
Title: Video Services Policy

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=windows+malware+strain+records+users+on+adult+sites&assettype=content_article&topicguid=&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&docid=33167546&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fforrester-report-building-a-customer-obsessed-iam-team-german%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&q=&cval=33167546;2150&ttag=&bhid=
Title: Forrester Report: Building A Customer-Obsessed IAM Team (German)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/company/akamai/
Title: Akamai

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=windows+malware+strain+records+users+on+adult+sites&assettype=content_article&topicguid=&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&docid=33165277&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fmidterm-elections-2018-how-7-states-are-fighting-cybersecurity-threats-from-russia-and-other-attackers-free-pdf%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&q=&cval=33165277;2150&ttag=&bhid=
Title: Midterm elections 2018: How 7 states are fighting cybersecurity threats from Russia and other attackers (free PDF)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/company/techrepublic/
Title: TechRepublic

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=windows+malware+strain+records+users+on+adult+sites&assettype=content_article&topicguid=&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&docid=33167553&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fbuild-vs-buy-a-guide-for-customer-identity-and-access-management-german%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&q=&cval=33167553;2150&ttag=&bhid=
Title: Build vs. Buy: A Guide for Customer Identity and Access Management (German)

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: cookie policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 75

https://tags.bluekai.com/site/20486?limit=0&id=5978151497031143237&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151497031143237%26eid=50056 HTTP 302
https://ml314.com/csync.ashx?fp=adfWBx9999efNc%2B5&person_id=5978151497031143237&eid=50056

Request Chain 76

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151497031143237 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5NzAzMTE0MzIzNxAAGg0I_Ynu6wUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=c081bc143b8fab08deefeccb3c76ef25ef57ed9f37fb6c3524764ccd126de958f4cb09cee1a4f8eb&person_id=5978151497031143237&eid=50082

Request Chain 77

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031143237%26eid=50220 HTTP 302
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031143237%26eid=50220&mm_bnc&mm_bct&UUID=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb HTTP 302
https://ml314.com/csync.ashx?fp=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb&person_id=5978151497031143237&eid=50220

Request Chain 78

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031143237 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031143237 HTTP 302
https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031143237

Request Chain 79

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2YTVLj7iPDJIRVKPnLyQezQIa-id9z0RAHiRRO4Qf8VE&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
https://ml314.com/csync.ashx?fp=2YTVLj7iPDJIRVKPnLyQezQIa-id9z0RAHiRRO4Qf8VE&person_id=5978151497031143237&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

Request Chain 80

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151497031143237&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151497031143237&redir=

Request Chain 110

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
https://www.everestjs.net/static/pixel_details.html

Request Chain 137

https://cm.everesttech.net/cm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFh1RS1nQUFCZmZrNWpuQA HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEGfd2j5Xt_GLLhIchuxJ2vk&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 145

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839 HTTP 302
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839&ja=1

Request Chain 148

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=

Request Chain 157

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=_4R7XfHPAorl3wOlxYzoDg&random=1536066475&sscte=1&crd=&gtd= HTTP 302
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959 HTTP 302
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959&ipr=y

Request Chain 352

https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=

Request Chain 369

https://tags.bluekai.com/site/20486?limit=0&id=5978151497031144163&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151497031144163%26eid=50056 HTTP 302
https://ml314.com/csync.ashx?fp=9%2BPfJx99999aNU%2B5&person_id=5978151497031144163&eid=50056

Request Chain 370

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151497031144163 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5NzAzMTE0NDE2MxAAGg0Ig4ru6wUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=&person_id=5978151497031144163&eid=50082

Request Chain 371

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031144163%26eid=50220 HTTP 302
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031144163%26eid=50220&mm_bnc&mm_bct&UUID=649d5d7b-7814-4b00-bfea-338405afca2f HTTP 302
https://ml314.com/csync.ashx?fp=649d5d7b-7814-4b00-bfea-338405afca2f&person_id=5978151497031144163&eid=50220

Request Chain 372

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031144163 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031144163 HTTP 302
https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031144163

Request Chain 373

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2taG-k9ngG2rIB5Ctcy8CC8KhfhbBis8jGcnTRkYGGHY&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
https://ml314.com/csync.ashx?fp=2taG-k9ngG2rIB5Ctcy8CC8KhfhbBis8jGcnTRkYGGHY&person_id=5978151497031144163&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

419 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/ 473 KB
110 KB 1283ms
1263ms Document
text/html 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ca90a7c4d7eab0b46bac622eb16844d85158d9c3b2d5a444eefe98d85608afdf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/windows-malware-strain-records-users-on-adult-sites/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
content-type: text/html; charset=UTF-8
cache-control: max-age=5400, private
x-tx-id: 30de5e93-feac-4112-91a5-0f59f3fb3041
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
expires: Fri, 13 Sep 2019 13:31:00 GMT
last-modified: Fri, 13 Sep 2019 12:01:00 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
accept-ranges: bytes
date: Fri, 13 Sep 2019 12:01:00 GMT
set-cookie: fly_device=desktop; expires=Fri, 20-Sep-2019 12:01:00 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Fri, 20-Sep-2019 12:01:00 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload

GET
H2 200 main-a8666d73c7-rev.css
zdnet1.cbsistatic.com/fly/1802-fly/css/core/ 357 KB
65 KB 34ms
6ms Stylesheet
text/css 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1186c32d6e1164efd9ca97ef49c4e2bd0eff1c61d650bac38c3bc7d01d2b8c72

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91840
status: 200
vary: Accept-Encoding
content-length: 65687
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:12 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c54-592bc"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:19 GMT

GET
H2 200 controls-8011bb0799-rev.css
zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/ 41 KB
7 KB 6ms
5ms Stylesheet
text/css 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-8011bb0799-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a1dc62195a78ed0cfecd916f04549f453c13a90f6d8d67dfc1ce2195ccb20e33

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91841
status: 200
vary: Accept-Encoding
content-length: 6556
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:25 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c61-a561"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:19 GMT

GET
H2 200 evidon-sitenotice-tag.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 69 KB
14 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293801
status: 200
vary: Accept-Encoding
content-length: 13960
x-xss-protection: 1; mode=block
last-modified: Mon, 09 Sep 2019 08:42:42 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d761082-1134e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Sep 2019 02:22:49 GMT

GET
H2 200 country.js Show response
c.evidon.com/geo/ 260 B
431 B 28ms
7ms Script
application/x-javascript 184.30.221.201
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/country.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 184.30.221.201 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-30-221-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
last-modified: Wed, 30 May 2018 22:23:16 GMT
server: Apache
status: 200
etag: "c1e367d098d326049811561575dbda4a:1527718996"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
access-control-max-age: 86400
accept-ranges: bytes
access-control-allow-headers: *
content-length: 165

GET
H2 200 snthemes.js Show response
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 94 KB
8 KB 13ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 526156
status: 200
vary: Accept-Encoding
content-length: 7763
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:20:31 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc82f-177f3"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Sep 2019 09:51:44 GMT

GET
H2 200 settings.js Show response
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 33 KB
2 KB 19ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 207510
status: 200
vary: Accept-Encoding
content-length: 1669
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:04:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d77ad75-828e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Sep 2019 02:22:30 GMT

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 en.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/ 311 KB
14 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32816
status: 200
vary: Accept-Encoding
content-length: 14353
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:06 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c4e-4ddff"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2019 02:54:04 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 910 B
1 KB 6ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
age: 5075489
status: 200
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 910
x-xss-protection: 1; mode=block
last-modified: Mon, 03 Sep 2018 02:32:23 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:08:02 GMT

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 this-android-malware-can-take-photos-and-5d3ee2c609ac9100018c9fff-1-aug-01-2019-14-08-18-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/08/01/0597f553-cef0-4ab9-965c-320a7452f33f/thumbnail/570x322/e9f2c25b902da24a762f3dd69f5bfb59/ 30 KB
30 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/08/01/0597f553-cef0-4ab9-965c-320a7452f33f/thumbnail/570x322/e9f2c25b902da24a762f3dd69f5bfb59/this-android-malware-can-take-photos-and-5d3ee2c609ac9100018c9fff-1-aug-01-2019-14-08-18-poster.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2f0557b0e113d89d7fc0559298d47b4478b75516989c159390a9326c3c575c1d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3083909
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 30535
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "614a24f6c582e220ada177041bab94fa"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 advertisement.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/ 53 B
142 B 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593355
status: 200
vary: Accept-Encoding
content-length: 71
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:20:31 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc82f-35"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Sep 2019 15:11:44 GMT

GET
H2 200 regin.png
zdnet4.cbsistatic.com/hub/i/r/2019/07/08/b0bcf6a6-d5b0-4788-8484-afb528f2f9a8/thumbnail/170x128/94395f77f33706b2913a6537f62020dc/ 18 KB
18 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/07/08/b0bcf6a6-d5b0-4788-8484-afb528f2f9a8/thumbnail/170x128/94395f77f33706b2913a6537f62020dc/regin.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0821a4e3c939f773991479316a8e6dbbe73959d2a1b2830ddd79567d51b94241

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3928304
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 18503
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "79b8072704504943c4a4e5900945f2a9"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 flame.png
zdnet4.cbsistatic.com/hub/i/r/2019/07/08/8a460c03-f622-45ad-834a-9ca3408f47bf/thumbnail/170x128/ee9fa64f648b0d75e327f56454a1c2c3/ 23 KB
23 KB 16ms
15ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/07/08/8a460c03-f622-45ad-834a-9ca3408f47bf/thumbnail/170x128/ee9fa64f648b0d75e327f56454a1c2c3/flame.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

936dc650424e586efd0dd47b9e2073864b0f2d224ba4eeffbe185aabaf545cbf

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3829206
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 23476
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "befa130dcb31961fa251d61e1e6ba0e1"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 stuxnet.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/08/7d9b8688-ae13-49b5-b5e4-525f2ac5ff26/thumbnail/170x128/f3d4e34bb87d561217090fdb4f6d469c/ 27 KB
27 KB 7ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/08/7d9b8688-ae13-49b5-b5e4-525f2ac5ff26/thumbnail/170x128/f3d4e34bb87d561217090fdb4f6d469c/stuxnet.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

29655aa4bb3dca26b3d6a18c3a4aadcf7a6d13718611dc8c12d86f66ebabefe5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3246320
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 27363
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "1fdd72b9fc6717195f76ea7c0783fa25"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 shamoon.png
zdnet4.cbsistatic.com/hub/i/r/2019/07/08/425ad5e4-30d3-477f-8da5-e3c47a159d00/thumbnail/170x128/2bc57b7723807c22d95a5ecf4a50af7e/ 24 KB
24 KB 15ms
14ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/07/08/425ad5e4-30d3-477f-8da5-e3c47a159d00/thumbnail/170x128/2bc57b7723807c22d95a5ecf4a50af7e/shamoon.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

12bdb2e244cdb7b686f139afaeb84701747cd38419ac2f5cc44d3805e9034079

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4095616
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 24615
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e1f70e23dce0d941aa028f900244a094"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 triton.png
zdnet4.cbsistatic.com/hub/i/r/2019/07/08/4e8bc7d3-5907-4c46-b75f-537bb529426e/thumbnail/170x128/2bc866b4f19fe9a7d2bdd1586769b5ac/ 24 KB
24 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/07/08/4e8bc7d3-5907-4c46-b75f-537bb529426e/thumbnail/170x128/2bc866b4f19fe9a7d2bdd1586769b5ac/triton.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

443238fc6591bfd1bc56ce75064045ecd9f8619bf2d2b18d8420c4d9b5baa618

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300346
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 24011
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8f51d048845867380207217d2b5c3156"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-09-13-at-10-07-53.png
zdnet3.cbsistatic.com/hub/i/r/2019/09/13/6b4a2fb8-d528-4d79-a6b6-ab1fd378d822/thumbnail/170x128/da674998f172e561810d40b1781a39b8/ 41 KB
41 KB 12ms
11ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/13/6b4a2fb8-d528-4d79-a6b6-ab1fd378d822/thumbnail/170x128/da674998f172e561810d40b1781a39b8/screenshot-2019-09-13-at-10-07-53.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b0ad479caca70c3c54db05714fa242f7ca229d1a4f4425d52249c0751cb49aa9

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
age: 141
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 42255
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "b22560c1f1d468cf9eb7100a430ef133"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-shady-hacker-in-front-of-computer.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/04/05/0a1d263f-18ce-4ba7-bd88-1428847c741b/thumbnail/170x128/61f7fba37db8a1fa99f91774153550e8/ 6 KB
6 KB 6ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/04/05/0a1d263f-18ce-4ba7-bd88-1428847c741b/thumbnail/170x128/61f7fba37db8a1fa99f91774153550e8/istock-shady-hacker-in-front-of-computer.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e6302f3f21b30baaa490c9ac8712f1d8f9bc737459853e998d57950c99dcee5c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3981
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5718
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "14eac0d254a6ccaf9b67584c7830a5c0"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-09-13-at-10-08-54.png
zdnet4.cbsistatic.com/hub/i/r/2019/09/13/dcdefd23-0d9c-4be9-acae-35ca6b61ac34/thumbnail/170x128/7a0ac9770ebd8e1cc221ade393dec658/ 48 KB
48 KB 15ms
15ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/13/dcdefd23-0d9c-4be9-acae-35ca6b61ac34/thumbnail/170x128/7a0ac9770ebd8e1cc221ade393dec658/screenshot-2019-09-13-at-10-08-54.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4abaff8cce54635705ffb6997ebebaad006c1f9e1a58db2480940ef307b24657

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4512
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 48573
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "9d9f448d935a04af924537c9aae20e2f"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 mag-white01.png
zdnet4.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/core/ 1 KB
1 KB 9ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91975
status: 200
vary: Accept-Encoding
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Sep 2019 18:15:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7939be-4f1"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:26:33 GMT

GET
H2 200 ring-animated.svg
zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/video/ 704 B
508 B 7ms
5ms Image
image/svg+xml 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/video/ring-animated.svg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-8011bb0799-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91837
status: 200
vary: Accept-Encoding
content-length: 364
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:19:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d7a1bb6-2c0"
strict-transport-security: max-age=31536000
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Sep 2020 10:30:22 GMT

GET
H2 200 Raleway-Bold.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 51 KB
51 KB 31ms
19ms Font
application/octet-stream 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
nncoection: close
age: 5075648
status: 200
vary: Accept-Encoding
content-length: 52212
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-cbf4"
strict-transport-security: max-age=31536000
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 Raleway-Light.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 30ms
18ms Font
application/octet-stream 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
age: 5075649
status: 200
vary: Accept-Encoding
content-length: 51608
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-c998"
strict-transport-security: max-age=31536000
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 Raleway-Regular.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 17ms
5ms Font
application/octet-stream 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
age: 4529821
status: 200
vary: Accept-Encoding
content-length: 51572
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jul 2019 16:01:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d35dde5-c974"
strict-transport-security: max-age=31536000
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jul 2020 01:11:57 GMT

GET
H2 200 bgp-spoofing-why-nothing-on-the-internet-is-actually-secure.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/09/18/61793069-3f0a-11e4-b6a0-d4ae52e95e57/thumbnail/170x128/9d6b89073de601224d1996d636aac065/ 11 KB
11 KB 6ms
5ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2014/09/18/61793069-3f0a-11e4-b6a0-d4ae52e95e57/thumbnail/170x128/9d6b89073de601224d1996d636aac065/bgp-spoofing-why-nothing-on-the-internet-is-actually-secure.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c14522a0a27837e68962e3644eb78695517bedf862ca1d6e972af4efcf67027c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
age: 24414
status: 200
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 10963
x-xss-protection: 1; mode=block
last-modified: Tue, 02 Dec 2014 01:51:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Sep 2020 05:14:06 GMT

GET
H2 200 beehive-cropped.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/05/29/0db35423-5b73-4b46-aab4-2df719c8651b/thumbnail/170x128/2c57a00a222943cd16da21b43b853171/ 6 KB
6 KB 9ms
8ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/05/29/0db35423-5b73-4b46-aab4-2df719c8651b/thumbnail/170x128/2c57a00a222943cd16da21b43b853171/beehive-cropped.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

77cbfc1b6dd1f22f70c6448c0755c40d9203ecf80c617895a9935565981d9b9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40683
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5557
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "7d3d5bcad324d3edc08e40738e663554"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-1126779135.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/12/ae3d7689-f726-47a3-a065-4bcf86a47de8/thumbnail/170x128/d7e1ad2dbbdba5e7ef42a636ef965963/ 10 KB
9 KB 9ms
8ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/12/ae3d7689-f726-47a3-a065-4bcf86a47de8/thumbnail/170x128/d7e1ad2dbbdba5e7ef42a636ef965963/istock-1126779135.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fe2255e2e70ac6ef64e3873fb73ed5cd8a957ca7fc00355e041069a904b6f377

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57832
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 9337
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "097fdff1eefae7180f5ec716a83dd3a3"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 msauthenticatorcloudbackup.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/12/a2fb9aec-b5f7-4187-9c01-dfcfa6a2452a/thumbnail/170x128/64fe69064e5a171c69ba287419dd68a9/ 4 KB
5 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/12/a2fb9aec-b5f7-4187-9c01-dfcfa6a2452a/thumbnail/170x128/64fe69064e5a171c69ba287419dd68a9/msauthenticatorcloudbackup.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ab5d41a2e1ab58cb21919cc930f8f4840f44196bff32c1c14962b9ba8f2015f1

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58758
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4439
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "80c94c09453dfe07681fde78e769353f"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sandboxie.png
zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/170x128/c17e684e4a3c8901b42fab28acb5e1e8/ 15 KB
15 KB 8ms
8ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/170x128/c17e684e4a3c8901b42fab28acb5e1e8/sandboxie.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

af7846155cf04065544b824a60dbc66f1adb852b1c120fce18ebab9b1b33c185

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59986
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 15289
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "f02b3153b7cd94c63d06aca54cb1e6e6"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-958122884.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/06/24/8979a44d-c4ff-4b71-98c9-47077920c3d0/thumbnail/170x128/37b1394b3d94e1ba01a50cb76c65755c/ 10 KB
9 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/06/24/8979a44d-c4ff-4b71-98c9-47077920c3d0/thumbnail/170x128/37b1394b3d94e1ba01a50cb76c65755c/istock-958122884.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

917cf9c26937a1463b36e8f38119a6448c29b5f04c4044e10e6900136a77ec89

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64831
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 9289
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e64c9ec33f19c7de745bd6b6d1a7a86e"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/1802-fly/js/libs/ 16 KB
6 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91840
status: 200
vary: Accept-Encoding
content-length: 6305
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:09 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c51-3f09"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:19 GMT

GET
H2 200 logo.png
zdnet1.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91975
status: 200
vary: Accept-Encoding
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Sep 2019 18:15:26 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7939be-1009"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:26:33 GMT

GET
H2 200 vendorlist.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 113 KB
51 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30413
status: 200
vary: Accept-Encoding
content-length: 52305
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:07 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c4f-1c3b9"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2019 03:34:06 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/1802-fly/js/ 209 KB
69 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fbb26cae740a8b9006ec97fef51427770ef98b2ec043928254af38a56d9ae11b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91839
status: 200
vary: Accept-Encoding
content-length: 70852
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:11 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c53-343bf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:21 GMT

GET
H/1.1 200
OK ls-zdnet.js Show response
js-sec.indexww.com/ht/ 85 KB
26 KB 25ms
6ms Script
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Sep 2019 11:05:58 GMT
Server: Apache
ETag: "da2c92-15269-5926d3d2a92f1"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=583
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 26184
Expires: Fri, 13 Sep 2019 12:10:44 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame F9B1 187 KB
55 KB 34ms
19ms Script
application/javascript 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-108-48-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Cache-Control: max-age=604800, s-maxage=604800
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Timing-Allow-Origin: *

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 41 KB
13 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce138e490f32cd41276c6425da7421d8c917ed0b90430b1abea775134e30e89b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "277 / 476 of 1000 / last-modified: 1568323759"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 13176
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:01 GMT

GET
H2 200 sfp.js Show response
native.sharethrough.com/assets/ 413 KB
117 KB 405ms
378ms Script
application/javascript 13.35.253.65
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.65 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-35-253-65.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c20d204fda0257be992a31867075cd51dbb5428c57e7805ee2fe4a1f08daf500

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Thu, 12 Sep 2019 20:31:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=3600
x-amz-cf-id: jaicF7cYG210Jn_LPN8LGbN1Wcpgah1q5bVbhrR3Lh-Y-0nEmsj5bg==
via: 1.1 b0954612f115b3d0a0db0a669e45ae8f.cloudfront.net (CloudFront)
expires: Thu, 12 Sep 2019 21:31:33 GMT

GET
H2 200 evidon-banner.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 8 KB
3 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47530
status: 200
vary: Accept-Encoding
content-length: 2440
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:22:04 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c4c-1faf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 22:40:17 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/3/1/2/2/ 0
120 B 286ms
95ms Image
text/plain 54.210.129.141
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/3/1/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.129.141 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-210-129-141.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 ;ord=1568376061301
ad.doubleclick.net/ddm/ad/uuzzg/jzesxcvpzc/ 43 B
205 B 15ms
15ms Image
image/gif 172.217.16.198
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/uuzzg/jzesxcvpzc/;ord=1568376061301?

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s08-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/3/4/2/2/ 0
120 B 261ms
96ms Image
text/plain 54.210.129.141
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/3/4/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.129.141 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-210-129-141.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 261ms
119ms Script
application/javascript 35.190.38.167
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
536 B 27ms
26ms XHR
application/json 54.77.88.162
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.88.162 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-77-88-162.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 304475115f769ed86ff1a2d0bc458933a279187eedeb8caa657247f04f6ebd54

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sun, 13 Oct 2019 12:01:01 GMT

GET
H2 200 scrolling-mpu-22779a851e-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 956 B
736 B 7ms
7ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157195
status: 200
vary: Accept-Encoding
content-length: 491
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:07:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d77ae21-3bc"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Sep 2019 16:21:06 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019090501.js Show response
securepubads.g.doubleclick.net/gpt/ 159 KB
58 KB 14ms
14ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019090501.js?21064570

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

1f948056b50b22854611638a2a293c1f4eb05e9b72c29b2e3f41eefabd789788

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Sep 2019 13:05:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 59665
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:01 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 93 KB
19 KB 27ms
6ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FC3) /
Resource Hash: 11786d0c519ee1ff5ca0ba0d699539e29b05c7273834da0954b3609025ad8303

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Wed, 04 Sep 2019 18:05:01 GMT
server: ECAcc (frc/8FC3)
etag: "744360132"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 19347
expires: Fri, 13 Sep 2019 12:06:01 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame F9B1 2 KB
1 KB 172ms
160ms XHR
application/json 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5227920&v=1.571.0&if=&sl=0&si=d3f5oirwc8-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-108-48-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3f2fd858500788978bcb0b96d6eb5fadb0764921a0f699adc576071d996d3c8f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 694

GET
H/1.1 200
OK isInternalUser.js Show response
iicbsi-a.akamaihd.net/common/js/esi/ 22 B
272 B 50ms
5ms Script
application/x-javascript 2a01:4a0:1338:28::c38a:ff11
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff11 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Cache-Control: max-age=293338
Server: AkamaiNetStorage
Connection: keep-alive
ETag: "fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length: 22
Content-Type: application/x-javascript

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 88ms
38ms Script
text/javascript 2606:4700::6810:a30d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a30d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27a1b8a51741d0473ab2eab70188657fd20d755ba84e0b3e6a51e6f94d7e3a4b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1523168
cf-ray: 5159f6d04b845952-VIE
status: 200
content-length: 27531
x-amz-id-2: eDK221dk774em4I6DMckLF57cozzz5yxbbsqbNOpYqfEO21OTmL1ZPH68Dxg4rRcOhYmJd75OLE=
last-modified: Mon, 29 Jul 2019 20:54:38 GMT
server: cloudflare
etag: "bdefbb6abea5b94d18f16f50ec3ebaae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CFF6D417906FF967
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Fri, 13 Sep 2019 12:31:01 GMT

GET
H2 200 utag.1779.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 3 KB
2 KB 10ms
9ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F05) /
Resource Hash: cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:57 GMT
server: ECAcc (frc/8F05)
etag: "392561602"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1785
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1782.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 10ms
9ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F54) /
Resource Hash: 791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Mon, 29 Oct 2018 17:20:42 GMT
server: ECAcc (frc/8F54)
etag: "3447796852"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1071
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1787.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 142 KB
48 KB 10ms
10ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F4A) /
Resource Hash: 95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Wed, 04 Sep 2019 18:05:01 GMT
server: ECAcc (frc/8F4A)
etag: "3504427907"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 48569
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1790.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
958 B 23ms
23ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F4D) /
Resource Hash: 10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (frc/8F4D)
etag: "2267415266"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 872
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1791.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 31ms
31ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FD1) /
Resource Hash: 7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (frc/8FD1)
etag: "3334871598"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1196
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1792.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 4 KB
2 KB 32ms
31ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FD0) /
Resource Hash: dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2016 14:28:47 GMT
server: ECAcc (frc/8FD0)
etag: "2022868805+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1664
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 utag.1797.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
972 B 32ms
32ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F79) /
Resource Hash: 3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
last-modified: Wed, 25 Jan 2017 20:07:58 GMT
server: ECAcc (frc/8F79)
etag: "1907756232+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 883
expires: Sat, 28 Sep 2019 12:01:01 GMT

GET
H2 200 lightbox.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 5FD7 326 B
382 B 17ms
16ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568376061458&lv=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 77bf6cf55ca271a4182754c87d95727d80838cc8cbf3fd0b4bcb8e7345fc1b4c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 65087
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5159f6d03cef5970-VIE

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 118ms
30ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?1382019
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Sep 2019 05:30:27 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=62966
Connection: keep-alive
Content-Length: 11933
Expires: Sat, 14 Sep 2019 05:30:27 GMT

GET
H/1.1 200
OK anonc.js Show response
dw.cbsi.com/ 73 B
620 B 502ms
149ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/anonc.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: 0643ff5416a6cde0a3a83371cf5f7f4f7c2ff4436fd3d6b9a5eb89d4f33bc00f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Apache/2.4.25
Etag: Sh3Mdl17hP2MTnw4rb8.1.dw_anonc
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control: private, max-age=43200, s-max-age=0
Connection: Keep-Alive
Content-Type: application/javascript
Keep-Alive: timeout=80, max=756
Content-Length: 73
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H/1.1 200
OK ds.js Show response
dw.cbsi.com/js/cbsi/ 18 KB
7 KB 489ms
150ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/js/cbsi/ds.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Sep 2017 19:06:40 GMT
Server: Apache/2.4.25
ETag: "1917-55916dc13f000"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200, s-maxage=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=426
Content-Length: 6423
Expires: Fri, 13 Sep 2019 12:31:01 GMT

GET
H/1.1 200
OK st.v3.js Show response
www.everestjs.net/static/ 25 KB
7 KB 27ms
6ms Script
application/x-javascript 184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/st.v3.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Aug 2019 09:05:18 GMT
Server: Apache
ETag: "1ff0663-624a-58fe7d2af0fea"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=32945
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7175
Expires: Fri, 13 Sep 2019 21:10:06 GMT

GET
H2 200 cbsinteractive.js Show response
tru.am/scripts/custom/ 3 KB
1 KB 256ms
209ms Script
text/javascript 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/custom/cbsinteractive.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: br
cf-cache-status: MISS
x-guploader-uploadid: AEnB2Uo5-s_siiAFhUadvN7GqUms1qhUAyTN99BCk_RzKwqIWl3uuJcqr5A1TfGUfkstg85rgXMv_LUr9Lc0Oo-R3ZY5dpX6cQ
x-goog-storage-class: REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Tue, 30 Apr 2019 19:32:26 GMT
server: cloudflare
etag: W/"c486c91d1321adf59073588524182108"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation: 1556652746634603
cache-control: public, max-age=86400
x-goog-stored-content-length: 2725
cf-ray: 5159f6d0bb86cbb8-VIE
expires: Sat, 14 Sep 2019 12:01:01 GMT

GET
H2 200 user.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 5FD7 739 KB
124 KB 18ms
18ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1568376061458&lv=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7bc2ad7ae7eed240bdba54adbc2fd6203ee5f6e2f98a13a6193dec1d45cc18a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: CXIxOSrQQ/L2LXBU6uAwoQ==
age: 65086
cf-polished: origSize=1166536
status: 200
last-modified: Thu, 12 Sep 2019 17:55:23 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: e3620cdd-501e-013a-3993-695037000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 5159f6d08d2e5970-VIE
expires: Sat, 12 Sep 2020 12:01:01 GMT

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
264 B 29ms
28ms Image
image/gif 2606:4700::6810:a30d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=3.2436353842434547
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a30d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
cf-cache-status: HIT
age: 9
cf-ray: 5159f6d09bb05952-VIE
status: 200
content-length: 43
x-amz-id-2: 7zuEfQ4DpkW+9tJkXi8rP8iettvh+76JESNEiC2oce55OzYsGCX5L7L3JH9FaLiL2fA40c84AC0=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 17C4A8DE225C39CC
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
103 B 30ms
30ms Image
image/gif 2606:4700::6810:a30d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=3.2436353842434547
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a30d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
cf-cache-status: HIT
age: 9
cf-ray: 5159f6d09bb15952-VIE
status: 200
content-length: 43
x-amz-id-2: 7zuEfQ4DpkW+9tJkXi8rP8iettvh+76JESNEiC2oce55OzYsGCX5L7L3JH9FaLiL2fA40c84AC0=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 17C4A8DE225C39CC
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 906 B
1 KB 30ms
30ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&pv=1568376061594_kceob87nd&bl=en-us&cb=3479246&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1568376061594_kceob87nd&cid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?1382019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 254d3f8a34c7588699b59df97f7e9192813f84c8a1cee5ac492d9df040c46f11

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:00 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 520
Expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
698 B 527ms
200ms Script
application/javascript 34.233.109.111
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=1382019
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?1382019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.109.111 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-233-109-111.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:00 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 138
Expires: Sat, 14 Sep 2019 12:01:01 GMT

GET
H2 200 article-11f1dcc08f-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 163 KB
46 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-11f1dcc08f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

277c3b1aa9849ea281525d0d823264cf6f245eebc87636cd03b587214f79f6cb

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330279
status: 200
vary: Accept-Encoding
content-length: 46654
x-xss-protection: 1; mode=block
last-modified: Mon, 09 Sep 2019 08:46:30 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d761166-28b5f"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Sep 2019 16:16:21 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://tags.bluekai.com/site/20486?limit=0&id=5978151497031143237&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151497031143237%26eid=50056
https://ml314.com/csync.ashx?fp=adfWBx9999efNc%2B5&person_id=5978151497031143237&eid=50056

43 B
312 B

62ms
29ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=adfWBx9999efNc%2B5&person_id=5978151497031143237&eid=50056
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:01 GMT

Redirect headers

Location: https://ml314.com/csync.ashx?fp=adfWBx9999efNc%2B5&person_id=5978151497031143237&eid=50056
Date: Fri, 13 Sep 2019 12:01:01 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: c5eb
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151497031143237
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5NzAzMTE0MzIzNxAAGg0I_Ynu6wUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=c081bc143b8fab08deefeccb3c76ef25ef57ed9f37fb6c3524764ccd126de958f4cb09cee1a4f8eb&person_id=5978151497031143237&eid=50082

43 B
312 B

43ms
42ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=c081bc143b8fab08deefeccb3c76ef25ef57ed9f37fb6c3524764ccd126de958f4cb09cee1a4f8eb&person_id=5978151497031143237&eid=50082
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:01 GMT

Redirect headers

date: Fri, 13 Sep 2019 12:01:01 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=c081bc143b8fab08deefeccb3c76ef25ef57ed9f37fb6c3524764ccd126de958f4cb09cee1a4f8eb&person_id=5978151497031143237&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031143237%26eid=50220
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031143237%26eid=50220&mm_bnc&mm_bct&UUID=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb
https://ml314.com/csync.ashx?fp=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb&person_id=5978151497031143237&eid=50220

43 B
312 B

29ms
28ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb&person_id=5978151497031143237&eid=50220
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:01 GMT

Redirect headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: MT3 1684 2519bb0 master zrh-pixel-x23
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ml314.com/csync.ashx?fp=89ce5d7b-7a00-4d00-bac9-61ae80dc7ecb&person_id=5978151497031143237&eid=50220
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Fri, 13 Sep 2019 12:01:00 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031143237
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031143237
https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031143237

43 B
312 B

32ms
30ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031143237
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:01 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:01 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031143237
Cache-Control: no-cache
X-Server: 10.45.25.65
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2YTVLj7iPDJIRVKPnLyQezQIa-id9z0RAHiRRO4Qf8VE&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
https://ml314.com/csync.ashx?fp=2YTVLj7iPDJIRVKPnLyQezQIa-id9z0RAHiRRO4Qf8VE&person_id=5978151497031143237&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

70 B
171 B

41ms
40ms

Image
image/gif

18.197.149.199
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.197.149.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Length: 70
Content-Type: image/gif

Redirect headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control: private
Connection: keep-alive
Content-Length: 168
Expires: Sat, 14 Sep 2019 08:01:01 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151497031143237&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151497031143237&redir=

42 B
776 B

32ms
32ms

Image
image/gif

34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151497031143237&redir=
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v042-0fb60dc14.edge-irl1.demdex.com 5.59.0.20190904135845 4ms (+1ms)
Pragma: no-cache
X-TID: DDoaIYRGQWE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
X-TID: aCaWHFe4SCU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151497031143237&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 74ms
6ms Script
application/javascript 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
age: 1396667
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by: cache-dca17747-DCA, cache-hhn4050-HHN
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1568376062.842781,VS0,VE0
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: F767A360D0453B01
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 135

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 66 KB
23 KB 7ms
7ms Script
application/x-javascript 2600:9000:20bb:2200:18:1fcd:349:ca21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20bb:2200:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:00:33 GMT
content-encoding: gzip
last-modified: Thu, 01 Aug 2019 01:36:07 GMT
server: nginx
age: 27
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA56
x-amz-cf-id: 6sVxzd18AnObBooAICHceCBCu_0K-ufVyMHP8iyLCxoT61arAIyMoQ==
via: 1.1 7ff3248f5aef149847858a974cf62b00.cloudfront.net (CloudFront)
expires: Fri, 13 Sep 2019 14:00:33 GMT

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 12 KB
5 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596492
status: 200
vary: Accept-Encoding
content-length: 4877
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:11 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc8cf-2fdf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Sep 2019 14:19:29 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 211ms
210ms XHR
application/json 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1568376061670&s=c2f6478f323f8c864c2b59a73ca642de9ec0a6f4b29084d98b489f5e13dcc420
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-108-48-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b88f2c465adfe21abb1f24f9daeb9c6bd8323ae56f19963bd36f9f6c80ea2714

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:01 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 737

GET
H2 200 fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/ 4 KB
1 KB 22ms
22ms Stylesheet
text/css 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637039077227986622
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: q4B4xYJoZwx9ikt94o1nCA==
age: 65082
cf-polished: origSize=6016
x-ms-meta-cbmodifiedtime: Wed, 10 Apr 2019 18:50:43 GMT
status: 200
last-modified: Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: 00a06310-b01e-003f-3893-69e21d000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 5159f6d1ee255970-VIE
expires: Sat, 12 Sep 2020 12:01:01 GMT

GET
H2 200 ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 572B 0
0 686ms
686ms Document
text/html 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637039077227986622
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.lightboxcdn.com
:scheme: https
:path: /lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637039077227986622
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: __cfduid=d1a327ff57ba348ae868ebce9f15afe771568376061
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
date: Fri, 13 Sep 2019 12:01:02 GMT
content-type: text/html
content-md5: xa1/rdPe0J6SwxlD7atkzw==
last-modified: Thu, 12 Sep 2019 17:55:22 GMT
x-ms-request-id: 85c5d1e9-a01e-00a8-692a-6a81d4000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
cf-cache-status: MISS
expires: Sat, 12 Sep 2020 12:01:02 GMT
cache-control: public, max-age=31536000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5159f6d1fe2a5970-VIE
content-encoding: br

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
118 B 18ms
18ms Image
image/gif 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1568376061740&h=www.zdnet.com&e=p&u=40913
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:01 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 622788
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5159f6d2beec5970-VIE
cf-bgj: imgq:85

GET
H2 200 ta-pagesocial-sdk.js Show response
tru.am/scripts/ 35 KB
12 KB 68ms
68ms Script
application/javascript 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by: Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 18 Apr 2019 03:51:14 GMT
server: cloudflare
age: 1526
etag: W/"942d5ae1e512ccdf18813550428dd002"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 5159f6d20f70cbb8-VIE
expires: Sat, 14 Sep 2019 12:01:01 GMT

POST
H2 200 beacon Show response
beacon.tru.am/ 0
331 B 222ms
163ms Fetch 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.tru.am/beacon
Requested by: Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:02 GMT
via: 1.1 google
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, private, max-age=0
cf-ray: 5159f6d2ea64cbb8-VIE
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 88ms
88ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&u=mZZ5IyvxI4T60Xy&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=3542&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2279&t=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&V=116&i=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&tz=-120&_acct=anon&sn=1&sv=ChK7C6G2T-TVWXwYCNxQ6nqcexf&sd=1&im=067b2ff3&_
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 41ms
34ms XHR
application/json 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1568376061995
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a32cf33bba3af043bb0e1c11d53d36400662a9d9b222adb460d0f80bc76ed969

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v042-0f760e7d8.edge-irl1.demdex.com 5.59.0.20190904135845 5ms (+1ms)
Pragma: no-cache
Content-Encoding: gzip
X-TID: FkNV/Oi4Sy4=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 674
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
139 B 7ms
6ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909041804&cb=1568376061997
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F1B) /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
last-modified: Thu, 14 Apr 2016 16:59:33 GMT
server: ECAcc (frc/8F1B)
etag: "2243872957"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Fri, 13 Sep 2019 12:11:02 GMT

GET
H/1.1 200
OK c.gif
dw.cbsi.com/clear/ 42 B
346 B 150ms
150ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&assettitle=windows%20malware%20strain%20records%20users%20on%20adult%20sites&assettype=content_article&pubdate=2019-08-08%2019%3A22%3A11&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1568376062001&ld=www.zdnet.com&ldc=3a1cd66c-81bd-4ddf-976d-18e94afb5b55&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=Sh3Mdl17hP2MTnw4rb8&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&title=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Keep-Alive: timeout=80, max=834
Content-Length: 42
Expires: Mon, 05 Jan 1970 12:12:12 GMT

POST
H/1.1 200
OK ping Show response
api.viglink.com/api/ 266 B
946 B 139ms
39ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/ping
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 0a677bb65787c5d53bf6830ad86e00c717e793f5ee13a0116017cb004fa0fda3

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 266
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame C4CB 0
0 126ms
31ms Document
text/html 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=06621856773385938274255468056300253772
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Tue, 10 Sep 2019 14:26:24 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=06621856773385938274255468056300253772;Path=/;Domain=.demdex.net;Expires=Wed, 11-Mar-2020 12:01:02 GMT;Max-Age=15552000
Vary: Accept-Encoding, User-Agent
X-TID: U23UgsvYQDI=
Content-Length: 2764
Connection: keep-alive

GET
H/1.1 200
OK id Show response
saa.cbsi.com/ 90 B
712 B 434ms
96ms XHR
application/x-javascript 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=06775154063812565394276730073629308724&ts=1568376062042
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: 779e659ab6020407ece5462b6a7c995dfa2c63373ef87dc17151a92332f8a52f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Server: Omniture DC
xserver: www93
Vary: Origin
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: https://www.zdnet.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 90

GET
H/1.1 204
No Content / Show response
0211c83e.akstat.io/ 0
354 B 229ms
215ms XHR
image/gif 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://0211c83e.akstat.io/?h.pg=article&when=1568376062144&t_other=custom4%7C1287&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=0d0d5a97e53c138d8c088186f189829f7b983f76&h.t=1568376061789&http.initiator=api&rt.start=api&rt.si=58da82aa-2bd1-45c9-935a-281ba4fb6ab9&rt.ss=1568376063723&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-48-32.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Fri, 13 Sep 2019 12:01:02 GMT

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 76 B
521 B 37ms
37ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 475cb34329f0cc4ae20402c8aea3739fe66574e592a8c9605cd94f220ad88f37

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:01 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 76
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
943 B 175ms
156ms XHR
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A90061109%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22f9a5d3bc-9e02-405b-8a5b-188f6b7dd868%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-09-13T12%3A01%3A01%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4380867f2fdf8f4fd45fe8fe1ebdc4bed353b5e84992ecf0e8da4a766e4238ca

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 86
Expires: Fri, 13 Sep 2019 12:01:02 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 54ms
19ms XHR
application/javascript 185.33.223.209
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=swmZtuvM&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

5f9a1d34ccb348e4fd8ebd514000155cb050981ac37b8672dec3cdfe54a494a7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.53:80
AN-X-Request-Uuid: a2c5041c-c754-491e-a88b-17517e51bf83
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 63ms
28ms XHR
application/javascript 185.33.223.209
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=4Xj0Uj6w&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

3c8e3b87b7ceb72fd9e41b22593c3e47f4d271dc8e75e87f5ec7dd9708033cb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.72:80
AN-X-Request-Uuid: a62ee77c-f02d-4e14-a786-75083dd2454a
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 75ms
40ms XHR
application/javascript 185.33.223.209
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=7lVnybPG&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

bb4da3deccd18a04bb7f38fc2fac3a529e7c247d08a6934dcb31a6b8d84dd234

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.142:80
AN-X-Request-Uuid: f6c04790-d46a-48d5-b9fd-35afe34b5fb9
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 62ms
27ms XHR
application/javascript 185.33.223.209
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=Cat4BIJK&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

d90d2c88e4b6330329a6947ce91be5e0b74da671819ac9c15883ddcf575c2ef8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.85:80
AN-X-Request-Uuid: 2198ffc1-85c1-4109-bda4-dfc87e8e3357
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 57ms
23ms XHR
application/javascript 185.33.223.209
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=Qoaxz7we&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

47457cf5d242b3bce0848024f1895820d37e16497ee929cec3672ae001c47f1e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.232:80
AN-X-Request-Uuid: cc3e5344-310a-48ed-b463-15f9edb42c5f
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 utag.1775.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 26 KB
9 KB 11ms
11ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FB3) /
Resource Hash: 0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Thu, 10 Nov 2016 20:41:55 GMT
server: ECAcc (frc/8FB3)
etag: "1112944691"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 8960
expires: Sat, 28 Sep 2019 12:01:02 GMT

GET
H2 200 utag.277.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
925 B 13ms
13ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FB4) /
Resource Hash: 0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (frc/8FB4)
etag: "461771432"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 863
expires: Sat, 28 Sep 2019 12:01:02 GMT

GET
H2 200 utag.1772.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 8ms
8ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FCD) /
Resource Hash: e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (frc/8FCD)
etag: "4198895974"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 959
expires: Sat, 28 Sep 2019 12:01:02 GMT

GET
H2 200 utag.1796.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 8 KB
3 KB 7ms
7ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FAA) /
Resource Hash: 9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Mon, 28 Nov 2016 15:09:53 GMT
server: ECAcc (frc/8FAA)
etag: "931235332"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2762
expires: Sat, 28 Sep 2019 12:01:02 GMT

GET
H2 200 utag.1810.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 8ms
8ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FE6) /
Resource Hash: 07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
last-modified: Mon, 08 Jul 2019 17:22:10 GMT
server: ECAcc (frc/8FE6)
etag: "4274102907"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 988
expires: Sat, 28 Sep 2019 12:01:02 GMT

GET
H/1.1

200
OK

pixel_details.html
www.everestjs.net/static/ Frame 0842
Redirect Chain

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
https://www.everestjs.net/static/pixel_details.html

0
0

10ms
9ms

Document
text/html

184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/pixel_details.html
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: www.everestjs.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache
Last-Modified: Tue, 04 Oct 2011 16:14:21 GMT
ETag: "8623-a6-4ae7b62583140"
Accept-Ranges: bytes
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 146
Cache-Control: max-age=24604
Expires: Fri, 13 Sep 2019 18:51:06 GMT
Date: Fri, 13 Sep 2019 12:01:02 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Server: Apache
Set-Cookie: everest_session_v2=XXuE-gAABffk5jn@; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XXuE-gAABffk5jn@; path=/; domain=.everesttech.net; expires=Sat, 07-Aug-2021 22:41:02 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://www.everestjs.net/static/pixel_details.html#google=XXuE-gAABffk5jn@&gsurfer=XXuE-gAABffk5jn@&optout=0&throttleCookie=&time=20190913120102
Content-Length: 345
Keep-Alive: timeout=15, max=996231
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 36ms
35ms XHR
application/json 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=06775154063812565394276730073629308724&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012EBDC27F052CE953-600009ABA0066F42&ts=1568376062557
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 566e363bc630e3298955b0e29b1bde4b259547a223aee5066d160a369aff466e

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v042-0b33fbfc2.edge-irl1.demdex.com 5.59.0.20190904135845 6ms (+1ms)
Pragma: no-cache
Content-Encoding: gzip
X-TID: bEppdWdxR48=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 671
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
2 KB 152ms
152ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3d14abd3048f0e77ff64ace93cbfe3ef48584bd0570bf7303b3bbf5ea0ffab6f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 515
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Sep 2019 11:58:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:02 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 67591850-d341-4e30-be96-b74bf4397319
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 13 Sep 2019 13:28:50 GMT

GET
H2 200 disqus-count-5922ea1c53-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 406 B
401 B 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593355
status: 200
vary: Accept-Encoding
content-length: 270
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc8c9-196"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Sep 2019 15:11:46 GMT

GET
H2 200 image-gallery-modal-e49526b449-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 359251
status: 200
vary: Accept-Encoding
content-length: 1909
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc8c9-13d0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Sep 2019 08:13:31 GMT

GET
H2 200 industroyer.png
zdnet3.cbsistatic.com/hub/i/r/2019/07/08/352e9411-0746-4aac-a8d6-e599794dceb9/thumbnail/170x128/f24741ef141bba7f096977bb9c6b0106/ 14 KB
14 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/07/08/352e9411-0746-4aac-a8d6-e599794dceb9/thumbnail/170x128/f24741ef141bba7f096977bb9c6b0106/industroyer.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

155935e0a93c8ec455550b190009b63e38f69b99ba20dbdc3da5dfe1271b89b7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4084552
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 13712
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "042aec9e604155f2f06c0a16c5f9ba06"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 duqu.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/08/1ed9a71d-b11e-4d38-a0a2-99435566bae2/thumbnail/170x128/5a7daabbc85ec370c59be15784b36c7d/ 27 KB
27 KB 7ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/08/1ed9a71d-b11e-4d38-a0a2-99435566bae2/thumbnail/170x128/5a7daabbc85ec370c59be15784b36c7d/duqu.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b105bb3b88371b52236270b355f1657b62bcebb2141a2e67fd6439bf981b1d99

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4205840
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 27423
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "0e31fe01bd51d1368eb9c4d9a3e4284e"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 plugx.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/08/a805a835-0a4d-45ad-8c6d-d744d5361b46/thumbnail/170x128/c160c0514b3910ddde37693cc246d521/ 6 KB
6 KB 10ms
10ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/08/a805a835-0a4d-45ad-8c6d-d744d5361b46/thumbnail/170x128/c160c0514b3910ddde37693cc246d521/plugx.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8f3c628048bb8f1f65090540cef37dedb3da8c58713b2d76710c87c9060edde0

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4205840
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5998
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "fa3060edb66e6ff4507886f9912e1ab9"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 winnti.png
zdnet4.cbsistatic.com/hub/i/r/2019/07/08/f0220f04-31c8-4d17-873a-f66e9c1bc390/thumbnail/170x128/7b5b52260c5a6750883cde914d0499a3/ 26 KB
26 KB 7ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/07/08/f0220f04-31c8-4d17-873a-f66e9c1bc390/thumbnail/170x128/7b5b52260c5a6750883cde914d0499a3/winnti.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d888280a72edc651af08047011eef087b2bc4d09580f91de2ffe09e22a52bdf0

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 307368
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 26341
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "085041a0a9f34e2125087d2c53fe6291"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 uroburos.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/08/b570b615-9755-48fc-a1b7-9ddb157e021a/thumbnail/170x128/c31da214d08ede8f4beb192154400d59/ 12 KB
12 KB 10ms
10ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/08/b570b615-9755-48fc-a1b7-9ddb157e021a/thumbnail/170x128/c31da214d08ede8f4beb192154400d59/uroburos.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0b02d7a500ed96bb84b65bbcb27ee8524a12424170a0f02aa8a0e4604df3d086

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3886868
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 12240
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d9dbc51dc534921589adf460c85cd824"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 disqus-loader-db6fae9369-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
894 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368385
status: 200
vary: Accept-Encoding
content-length: 642
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc8c9-580"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Sep 2019 05:39:12 GMT

GET
H2 200 istock-shady-hacker-in-front-of-computer.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/04/05/0a1d263f-18ce-4ba7-bd88-1428847c741b/thumbnail/70x53/3a7b7331726048bc4a1a86e844964ad0/ 4 KB
4 KB 7ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/04/05/0a1d263f-18ce-4ba7-bd88-1428847c741b/thumbnail/70x53/3a7b7331726048bc4a1a86e844964ad0/istock-shady-hacker-in-front-of-computer.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6b538b22c527e15b62647c3533348500bb8b924c8ad20c2235929d1b3155703c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3982
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3707
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "c6447300d99fdbf4f3f7966295b8b5be"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screen-shot-2016-12-09-at-2-04-38-pm-2.png
zdnet3.cbsistatic.com/hub/i/r/2016/12/09/9db97787-51ce-41a7-9e47-c5916b0d3294/thumbnail/70x53/413bebf57742fb89ff38602d0f41b850/ 11 KB
11 KB 8ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2016/12/09/9db97787-51ce-41a7-9e47-c5916b0d3294/thumbnail/70x53/413bebf57742fb89ff38602d0f41b850/screen-shot-2016-12-09-at-2-04-38-pm-2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f46d40bf061892a5c2b8eccde5afa89377d576c9bfb637644b9e700b680d141d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48235
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 10906
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e7fdeae58bfddf97dba9f1f67abf5921"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sandboxie.png
zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/70x53/e94e973f16f88e4c56074311329f5248/ 4 KB
4 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/70x53/e94e973f16f88e4c56074311329f5248/sandboxie.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6609393ea122a21291adb391b0e2569df37c08df6e9dc4a0a23718ddfa0c6426

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59927
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4463
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "bfd2308e9e75263970f8079115edebbd"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 simjacker-attack.png
zdnet2.cbsistatic.com/hub/i/r/2019/09/12/729cfdfd-7784-460e-a37e-054d376095a0/thumbnail/70x53/9c451da1ac920e3ac16d2ecbbcd7adb0/ 6 KB
6 KB 6ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/12/729cfdfd-7784-460e-a37e-054d376095a0/thumbnail/70x53/9c451da1ac920e3ac16d2ecbbcd7adb0/simjacker-attack.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

acef9f0144814366d43343ac550898f312205f40d60a5cdee1a93f00c188cc13

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
x-content-type-options: nosniff
age: 80973
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5929
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "05f17e3cfa5de42020eaa6df34fb4805"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
2 KB 345ms
345ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

0c2f109ae0c67290a3e4c7e0df0404e71697a5176711fb666c34d6d990d209a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 730
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:02 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 7595cb2b-fb57-479a-acc6-e4f4b57234f6
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Fri, 13 Sep 2019 12:01:02 GMT

GET
H2 200 front-door-carousel-56427878d9-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 6ms
4ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596490
status: 200
vary: Accept-Encoding
content-length: 1564
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc8c9-124a"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Sep 2019 14:19:31 GMT

GET
H2 200 urban-airship-29ae327ed0-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
936 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229684
status: 200
vary: Accept-Encoding
content-length: 827
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:07:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d77ae21-514"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Sep 2019 20:12:59 GMT

GET
H2 200 advertisement-d41d8cd98f-rev.js Show response
zdnet2.cbsistatic.com/fly/js/utils/ 0
302 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
x-content-type-options: nosniff
age: 190209
status: 200
vary: Accept-Encoding
content-length: 0
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:07:46 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d77ae32-0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Sep 2019 07:10:53 GMT

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame 86CA 0
0 33ms
32ms Document
text/html 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=06621856773385938274255468056300253772; dextp=269-1-1568376062200|477-1-1568376062301|771-1-1568376062402|22052-1-1568376062503|30646-1-1568376062604
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Tue, 10 Sep 2019 14:29:02 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=06621856773385938274255468056300253772;Path=/;Domain=.demdex.net;Expires=Wed, 11-Mar-2020 12:01:02 GMT;Max-Age=15552000
Vary: Accept-Encoding, User-Agent
X-TID: LxecKgFmRqw=
Content-Length: 2764
Connection: keep-alive

GET
H/1.1 200
OK s020746249276 Show response
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/ 2 KB
2 KB 435ms
435ms Script
application/x-javascript 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s020746249276?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=13%2F8%2F2019%2014%3A1%3A2%205%20-120&d.&nsid=0&jsonv=1&.d&mid=06775154063812565394276730073629308724&aid=2EBDC27F052CE953-600009ABA0066F42&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=eset%2C%20llc&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C11ec38e5-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=windows%20malware%20strain%20records%20users%20on%20adult%20sites&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=aab7e17d-2bcd-45fa-9c2f-40266416e46d&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=24b81636-bab9-41c8-9b82-7f5bca5d1193&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=Sh3Mdl17hP2MTnw4rb8&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: ee8daf97d63fa07c28a2625b3c76dd63680ffc520b66c754f127f538591910a6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-AAM-TID: 1MCKLrR8QCc=
Date: Fri, 13 Sep 2019 12:01:02 GMT
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 1598
DCS: dcs-prod-irl1-v042-08d96941e.edge-irl1.demdex.com 5.59.0.20190904135845 9ms (+1ms)
Pragma: no-cache
Last-Modified: Sat, 14 Sep 2019 12:01:02 GMT
Server: Omniture DC
xserver: www444
ETag: "3368061947146436608-5121659129190284740"
Vary: *
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Thu, 12 Sep 2019 12:01:02 GMT

GET
H2 200 comscore.streaming.6.1.1.171219.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/ 104 KB
19 KB 6ms
6ms Script
application/javascript 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
age: 2226224
x-cache: HIT, HIT
status: 200
content-length: 18881
x-amz-id-2: neN7zmXGABIZIsD8sbebZF9DlZwNnRoW8FayLQeAr6iI61AA4xefpinkv4fSD61J73FNfhwdnmU=
x-served-by: cache-dca17772-DCA, cache-hhn4050-HHN
last-modified: Fri, 01 Feb 2019 18:21:03 GMT
server: AmazonS3
x-timer: S1568376063.688738,VS0,VE0
etag: "c3c30c0ebfc35a9426296256fc3133d8"
vary: Accept-Encoding
x-amz-request-id: 2141EBE8710B207D
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 173, 20

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 97 KB
13 KB 592ms
592ms XHR
text/plain 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=482274738421342&correlator=2721633825244631&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21064570%2C21062414%2C21062888%2C21064170%2C21064267&vrg=2019090501&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190913&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=64&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cwindows%26mfr%3Deset-llc%26tag%3Dmalware%252Ctarget%26prodtype%3Dantivirus%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dwindows-malware-strain-records-users-on-adult-sites%26env%3Dprod%26firstpg%3D1%26vguid%3Daab7e17d-2bcd-45fa-9c2f-40266416e46d%26session%3Df%26subses%3D6&cookie_enabled=1&bc=31&abxe=1&lmt=1568376060&dt=1568376062705&dlt=1568376060900&idt=496&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=2066466350%2C1323958490%2C2600359504%2C2603228583%2C3491298639%2C444414678%2C3720602287%2C1880526948&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&dssz=79&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x3553%7C1585x0%7C1585x0%7C370x0%7C370x0%7C370x250%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C300x280%7C300x280%7C728x130%7C371x771&ga_vid=438170474.1568376063&ga_sid=1568376063&ga_hid=811086615&fws=132%2C4%2C132%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019090501.js?21064570

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

3a5d8f2eca449cbe28a2dfb6274b459183da7747b2b10d19aeedd30983b6b523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13268
x-xss-protection: 0
google-lineitem-id: 4745699004,-2,241984809,241984809,253246569,253246569,241984809,4825966980
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138245072116,-2,75374362809,75375443409,75375443409,138271735246,138271463498,138247024569
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019090501.js Show response
securepubads.g.doubleclick.net/gpt/ 63 KB
24 KB 14ms
13ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019090501.js?21064570

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

4021f17f04d1808610fd53096d9a57e97d86a7d8c94cd86b970640c4f99a70c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Sep 2019 13:05:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 24375
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:02 GMT

GET container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 0
0

GET
H/1.1 200
OK 4083-12969.js Show response
www.everestjs.net/dl/4083/ 484 B
664 B 6ms
6ms Script
application/x-javascript 184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/dl/4083/4083-12969.js
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Nov 2013 14:23:10 GMT
Server: Apache
ETag: "4a5a49-1e4-4ec011a776f80"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=59928
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 288
Expires: Sat, 14 Sep 2019 04:39:50 GMT

GET
H/1.1 200
OK v
pixel.everesttech.net/4083/ 128 B
716 B 15ms
14ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ev___ref=%2F%2F
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "9c38d7-80-53f3f17013d40"
Vary: Cookie
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=998584
Content-Length: 128

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/
Redirect Chain

https://cm.everesttech.net/cm
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFh1RS1nQUFCZmZrNWpuQA
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEGfd2j5Xt_GLLhIchuxJ2vk&google_cver=1
https://pixel.everesttech.net/1x1

128 B
407 B

14ms
13ms

Image
image/png

66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "443742-80-53f3f17013d40"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=996166
Content-Length: 128

Redirect headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://pixel.everesttech.net/1x1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 ima3.js Show response
s0.2mdn.net/instream/html5/ 256 KB
87 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2006
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/html5/ima3.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a1e6a90e18e03532611add928ef3529599c27b5a357a8bc78d3fe85d05d9671b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 88468
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:02 GMT

GET
H2 200 feature-disabled-d41d8cd98f-rev.js Show response
zdnet3.cbsistatic.com/fly/js/ 0
102 B 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/feature-disabled-d41d8cd98f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
x-content-type-options: nosniff
age: 237023
status: 200
vary: Accept-Encoding
content-length: 0
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:07:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d77ae21-0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Sep 2019 18:10:40 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 121 KB
32 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 31604
x-xss-protection: 0
pragma: public
x-fb-debug: s6ezpBGsw04JLQTWinzF1KuZiXD4rzefwwz3aC2Vo0Vi7nMFN0tvT0BtuhuUS4kdWmgZM1rn7ddrqOdlYmAp2Q==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Fri, 13 Sep 2019 12:01:02 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/12/729cfdfd-7784-460e-a37e-054d376095a0/thumbnail/70x53/9c451da1ac920e3ac16d2ecbbcd7adb0/simjacker-attack.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

acef9f0144814366d43343ac550898f312205f40d60a5cdee1a93f00c188cc13

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
x-content-type-options: nosniff
age: 80973
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5929
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "05f17e3cfa5de42020eaa6df34fb4805"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/04/05/0a1d263f-18ce-4ba7-bd88-1428847c741b/thumbnail/70x53/3a7b7331726048bc4a1a86e844964ad0/istock-shady-hacker-in-front-of-computer.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6b538b22c527e15b62647c3533348500bb8b924c8ad20c2235929d1b3155703c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3982
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3707
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "c6447300d99fdbf4f3f7966295b8b5be"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sandboxie.png
zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/70x53/e94e973f16f88e4c56074311329f5248/ 4 KB
5 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/12/8206a4a8-191e-4b3c-bd8b-7b0d9bdc1bf1/thumbnail/70x53/e94e973f16f88e4c56074311329f5248/sandboxie.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6609393ea122a21291adb391b0e2569df37c08df6e9dc4a0a23718ddfa0c6426

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59927
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4463
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "bfd2308e9e75263970f8079115edebbd"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2016/12/09/9db97787-51ce-41a7-9e47-c5916b0d3294/thumbnail/70x53/413bebf57742fb89ff38602d0f41b850/screen-shot-2016-12-09-at-2-04-38-pm-2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f46d40bf061892a5c2b8eccde5afa89377d576c9bfb637644b9e700b680d141d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48235
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 10906
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e7fdeae58bfddf97dba9f1f67abf5921"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839&ja=1

44 B
332 B

31ms
31ms

Image
image/gif

54.194.74.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839&ja=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.74.162 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-194-74-162.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:02 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:02 GMT
server: nginx
status: 302
location: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp=&ts=compact&rnd=1568376062839&ja=1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 cbs_zQTp2H_zdnet.js Show response
cdn-magiclinks.trackonomics.net/client/static/v2/ 95 KB
18 KB 55ms
8ms Script
text/javascript 2600:9000:2057:d600:1d:8c8c:47c0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909041804
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:d600:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash: 735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Sep 2019 17:31:01 GMT
content-encoding: gzip
last-modified: Wed, 21 Aug 2019 10:15:58 GMT
server: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age: 66401
status: 200
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 2LVYHjDzHjbEm-E4lvbUQxaYdSklET9ut-OwKE9DLzrA6z3yFCf7nQ==
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)

GET
H/1.1 200
OK cs.js Show response
sb.scorecardresearch.com/c2/3005086/ 0
400 B 8ms
7ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Apr 2011 23:11:26 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=259200
Connection: keep-alive
Content-Length: 20
Expires: Mon, 16 Sep 2019 12:01:02 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%...

0
248 B

7ms
7ms

Image
text/plain

184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1568376062842&ns_c=UTF-8&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=
Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 60 KB
15 KB 63ms
27ms Script
application/javascript 104.17.209.240
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909041804

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

661582515dd231f99fdd37d11c1237a8e001ab99b898dc1430ac2f73f718098c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 299616
cf-polished: origSize=62037
status: 200
edge-control: max-age=604800
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-bgj: minify
server: cloudflare
x-powered-by: Express
etag: W/"f255-UCA7wINInts3OI0TBl6iZ+HnnBg"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=604800
cf-ray: 5159f6d90b2fdfdf-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
337 B 31ms
19ms XHR
text/plain 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:02 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Fri, 13 Sep 2019 12:01:02 GMT

GET
H/1.1 200
OK z Show response
lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/ 218 B
510 B 485ms
121ms Script
application/javascript 23.99.128.52
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1568376062937&callback=jQuery17103190816284155287_1568376061731&_=1568376062937
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: waws-prod-dm1-001.cloudapp.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: de5dfbbb6deb54cae10e339cce4fb4b9606fc7b69f4032779f520e0295f745c7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:02 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Content-Length: 297
Vary: Accept-Encoding
Content-Type: application/javascript

GET
H2 200 z.gif Show response
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO... 183 B
358 B 17ms
17ms XHR
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5106a4e511706df433181790f4549462307d69dc064ac24e3c3520c201b89611

Request headers

Accept: */*
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: br
cf-cache-status: HIT
age: 4480
x-powered-by: ASP.NET
status: 200
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
access-control-allow-credentials: true
cf-ray: 5159f6d96f8e59be-VIE
expires: Sat, 14 Sep 2019 12:01:02 GMT

GET
H2 200 fly-disqus-count-1f604770a3-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 882 B
549 B 8ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 365936
status: 200
vary: Accept-Encoding
content-length: 460
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc8c9-372"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Sep 2019 06:22:06 GMT

GET
H2 200 ua-sdk.min.js Show response
web-sdk.urbanairship.com/notify/v1/ 78 KB
17 KB 33ms
6ms Script
application/javascript 35.227.208.151
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 151.208.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 11:56:19 GMT
content-encoding: gzip
x-goog-meta-goog-reserved-file-mtime: 1556302399
age: 284
x-guploader-uploadid: AEnB2UpnMFiR8hOmrlPg-KzTNpiHY6IcFMI3L_lY3gz8TzPg3xJs4Lv3ABUfY9xSVr0wUeRyNCIEP9v4btsj5LuYEbaBrsD5ow
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 16960
last-modified: Fri, 26 Apr 2019 18:13:21 GMT
server: UploadServer
etag: "251defdc0ecc8a3bad8ae4cf9aab1923"
vary: Accept-Encoding
x-goog-hash: crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation: 1556302401249893
cache-control: public, max-age=300
x-goog-stored-content-length: 16960
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 13 Sep 2019 12:01:19 GMT

GET
H2 200 show-hide-1.0-7dc26ff326-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
869 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 93198
status: 200
vary: Accept-Encoding
content-length: 710
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Sep 2019 18:17:57 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d793a55-7a5"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:07:44 GMT

GET
H2 200 309391486091569 Show response
connect.facebook.net/signals/config/ 307 KB
78 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309391486091569?v=2.9.4&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 79752
x-xss-protection: 0
pragma: public
x-fb-debug: CNevAORo+O4NPn/kR6rKbXuN/CFIMGWPBdQAeVdGBuZ64LAz3Dbh9QTDwEVCEIeOfhp66gkiqgZtAKhmn29VjA==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Fri, 13 Sep 2019 12:01:03 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=_4R7XfHPAorl3w...
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959&ipr=y

42 B
110 B

21ms
20ms

Image
image/gif

2a00:1450:4001:81e::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1536066475&crd=&is_vtc=1&random=558478959&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel
ad.yieldmanager.com/ 0
341 B 347ms
110ms Image
text/plain 2001:4998:58:4904::7000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldmanager.com/pixel?id=2447099&t=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2001:4998:58:4904::7000 , United States, ASN26101 (YAHOO-3 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK s
pixel.everesttech.net/4083/ 128 B
702 B 19ms
18ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/s?s=12969
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "443742-80-53f3f17013d40"
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=996171
Content-Length: 128

GET
H2 200 VideoHeartbeat-2.0.2.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/ 143 KB
29 KB 8ms
7ms Script
application/javascript 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
age: 1939756
x-cache: HIT, HIT
status: 200
content-length: 28977
x-amz-id-2: +2U9dXma+eMS0pCyjOsjSQxM2XeIVTtFChnnV0tNV/KxKbDrO0L+Wu3OXPxKg3U2iN4g4fPtx3Y=
x-served-by: cache-dca17740-DCA, cache-hhn4050-HHN
last-modified: Fri, 01 Feb 2019 18:21:02 GMT
server: AmazonS3
x-timer: S1568376063.078678,VS0,VE0
etag: "215943f0e77b4fcc9cc72b98a8ea1cfc"
vary: Accept-Encoding
x-amz-request-id: B56B3145A1D646B8
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 162, 84

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 178ms
176ms XHR
application/json 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1568376063107&s=8b9dbcb8382f257cf012c4818ca7246d3f41ce60e9f635a4a4885f7ee633ef5a
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-108-48-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0f5494fdf23362c3399a615baed6c55d8410af6685e2aeb1499758a1c397de98

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 735

GET count.js
zdnet-1.disqus.com/ 0
0

GET
H2 200 inferredEvents.js Show response
connect.facebook.net/signals/plugins/ 35 KB
10 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 10218
x-xss-protection: 0
pragma: public
x-fb-debug: tTYjbfsIOfZBm9mk3l/FN3UucBMdhbjePUjKUvZSqrUnAUOU/oc4WoNjQ9bAH3/8IN5KgTdUNTKko+nJdoO6zA==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Fri, 13 Sep 2019 12:01:03 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 AppMeasurement-2.3.0.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/ 77 KB
27 KB 6ms
6ms Script
application/javascript 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
age: 1388574
x-cache: HIT, HIT
status: 200
content-length: 27260
x-amz-id-2: kLgdw2sQfzW8EBCh5gIdAjguNFSLxkDKLDKkIhVUuGHzfy43GfeyKZQFej1nTwA00aYX5B/mtiI=
x-served-by: cache-dca17775-DCA, cache-hhn4050-HHN
last-modified: Fri, 01 Feb 2019 18:21:02 GMT
server: AmazonS3
x-timer: S1568376063.175151,VS0,VE0
etag: "d71ba6c9a930b6864408830c3e2705f9"
vary: Accept-Encoding
x-amz-request-id: C7320C852C9DB622
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 16, 81

GET
H2 200 bcn
www.summerhamster.com/ 43 B
181 B 51ms
30ms Image
image/gif 35.157.160.140
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.summerhamster.com/bcn?fe=1568376063195&y=2.0.1105&elg=850256119&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fzlqgrzv-pdozduh-vwudlq-uhfrugv-xvhuv-rq-dgxow-vlwhv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fxxccj%2Fmchvafyscf%2F%3Brug%3D1568376061301%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.160.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-157-160-140.eu-central-1.compute.amazonaws.com
Software: Jetty(9.2.10.v20150310) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 13 Sep 2019 12:01:03 GMT
server: Jetty(9.2.10.v20150310)
access-control-allow-origin: *
content-length: 43
access-control-allow-methods: *
content-type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 44 B
324 B 41ms
28ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&rl=&if=false&ts=1568376063207&sw=1600&sh=1200&v=2.9.4&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1568376063206.488263915&it=1568376063016&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 ggcmb510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 12 KB
5 KB 58ms
13ms Script
application/javascript 2600:9000:2057:6800:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: 7mioloFf72U0Qkc4Taa4MD_zEyvZEgsP
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 15:40:32 GMT
server: AmazonS3
age: 3803
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Fri, 13 Sep 2019 11:35:22 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 8rCdXgR7wOe3kOYBJwPbJXr_t23SCZv_-IX2G62SrzXqFVyrAYh4RA==
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)

POST
H/1.1 204
No Content /
686eb51b.akstat.io/ 0
354 B 289ms
269ms Other
image/gif 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://686eb51b.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-48-32.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 mux.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/ 81 KB
25 KB 6ms
6ms Script
application/javascript 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
age: 1574111
x-cache: HIT, HIT
status: 200
content-length: 25193
x-amz-id-2: TGcpi0DTUixP906ah+mUc5NccBcsisIooRo5Bctp8JdEs70Aa2+LP6DbaRc35WRNcZSF0h29Qqw=
x-served-by: cache-dca17734-DCA, cache-hhn4050-HHN
last-modified: Fri, 01 Feb 2019 18:21:06 GMT
server: AmazonS3
x-timer: S1568376063.302062,VS0,VE0
etag: "5d69e0e991739e9cd3f544944c8b3739"
vary: Accept-Encoding
x-amz-request-id: 22D38B7EB978846A
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 192, 77

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 2216 0
277 B 18ms
18ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstKeBFTdNj9SizpxjFxdZ71QX0ltikB3y_gH00lNZTth4r0O_09FjDMH9llAyqdTQnUqT5gqyLJbF3fZKtfMyjDkx4sa_deVg3OwyJUm0qL2KvZdckMrcAkX1Bx5x7tqfabhxE89xl0oyjefKrc7IppWRIrc73b18dKF29nqrexFLkJUYywWW8ebQGDTKOZO-nDAP0I3Wsa9J855fhDl-dG3jYaPCom9CxQKquXF9Kw5EuLNbqnRs1vti24IXqpKktGT0trKZlS&sig=Cg0ArKJSzG5HPcKSsr4XEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2216 75 KB
28 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 2216 307 KB
103 KB 29ms
8ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 76 KB
28 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019090501.js?21064570

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 711E 0
247 B 21ms
18ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPgy-Uj-CYTATVkexvxxxDcYaTb5oKVCqyTxcoENHBU9WueKzlVU1_mNQpWOAeqAvIeTZjIMZhxkMMupgmPbgylp7JfFSt44TOfjTsmewhXdAn1AdJJHa1Bz3XPGnoldi_NK067HrkdAL42R5M8dp0IEcK_NShdYG-eL1ocJWKTeQuGeNtvFaXxI-1nInJUzgSdU-D7iWk0zktsDUoVgM_RBQSfhYo-93elSze_3M2gmIp3RH_-Punqw5l5vA0ppyO5nA&sig=Cg0ArKJSzLKun1Srg7npEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 711E 26 KB
8 KB 29ms
7ms Script
text/javascript 2.19.38.84
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-38-84.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=4343
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Fri, 13 Sep 2019 13:13:26 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 711E 76 KB
29 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

73e692ea3d418746a8f3deb127e08cf6aaeaf4bbc244663a12a0359daada31ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568200475766372"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 29125
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 711E 307 KB
103 KB 19ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 10C4 0
57 B 21ms
19ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmQjCiXSrMkHj2OIUMPz-3c5iRtKCx2oBjjIlMQAY1S1gM3NJksHSCrTVzuvCJFbuKdHAyXfwFZYUNtLMSOpiM7UzSBvDcQEJNk1GVKm00Cyo0nf0By7eE5GClwFTaFC8a_jX98WuECOykOr7KH1rUT_aS8y36v68lTQmplscNfYs7jgaQy62P3M1P_X7ib45Lb05CzGIL9EiGkoHbxFe9K3JP3a1CvhJtCeQKpu0rsv3gVd9vw3xLFkRCXtsM7KG9FzI&sig=Cg0ArKJSzO0lC7X2p9N3EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 10C4 26 KB
8 KB 22ms
7ms Script
text/javascript 2.19.38.84
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-38-84.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=4343
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Fri, 13 Sep 2019 13:13:26 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 10C4 75 KB
28 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 10C4 307 KB
103 KB 19ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame E8E5 0
48 B 21ms
18ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJGDw4QLOheINHn7ESxv-KLAVjVqdxYvLE_U4h19B36Qfh1w2q_iuiLO--yf-lRe8yfpeHC31c1aUT8QDGAiG25qos1QZbZKN0ZE6UY5g8AAeE6npz6as2JL5srnFy9RFQh4wUfkUq5DULL4tsru7ksULagSJF5nOejzVfggEYRDYppVxGyy7461vev3RY8YPkaJXDWf40cHZOIUE9RWwANweOu4IpMFwZHn0pS43g41ZlMgSBnxjpIoB2_ewCoFlhap4&sig=Cg0ArKJSzH_jT7x95vhYEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame E8E5 26 KB
8 KB 19ms
6ms Script
text/javascript 2.19.38.84
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-38-84.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=4343
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Fri, 13 Sep 2019 13:13:26 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame E8E5 75 KB
28 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame E8E5 307 KB
103 KB 16ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 206 uvp_blank.mp4
vidtech.cbsinteractive.com/h5/blanks/ 11 KB
11 KB 28ms
26ms Media
video/mp4 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/h5/blanks/uvp_blank.mp4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
via: 1.1 varnish, 1.1 varnish
age: 3904484
x-cache: HIT, HIT
status: 206
x-cache-hits: 44274, 27753
content-length: 11247
x-amz-id-2: RWSuYoveoPlVL8+CKVrvoJOxvT/jZR2ccK055Pg68MOkg2YkaejHy+1cH72KSfRTxtYrLSmSGpM=
x-served-by: cache-dca17769-DCA, cache-hhn4050-HHN
content-range: bytes 0-11246/11247
last-modified: Fri, 21 Dec 2018 00:54:05 GMT
server: AmazonS3
x-timer: S1568376063.427497,VS0,VE0
etag: "707bb2a4c9141aba1068d851f5be0409"
x-amz-request-id: 4F6B1AEF2D270DCA
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: video/mp4
x-amz-meta-mtime: 1296432000

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 459B 0
57 B 23ms
20ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsualaDVBwJoa2LMqUu7kAvX-kDBhSzk7lUAQbFgIcnrvWGbBolan1wI_B5dg6l4YWHbu4XbetQwQyJhkJiy4ZsEZJUXKNJAQsbmMNOOgqeyV9HB0T-EO2Y8qs9t0d5vGbcLUkr0pSxk0GOSNYj_0y7l4g216ZkP18HT--yP3J5n6Hd6bMFpsJ19xuznZWvtEe6lpwBNcjRYcmMSSW7N4FegUkzm-ASi4IiQyK9bkPWQ3OSP9UO5N2iAsuofFvLYpxsosYA&sig=Cg0ArKJSzIIZLiMybEGDEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 459B 26 KB
8 KB 10ms
9ms Script
text/javascript 2.19.38.84
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-38-84.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=4343
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Fri, 13 Sep 2019 13:13:26 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 459B 75 KB
28 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 459B 307 KB
103 KB 14ms
14ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 2891 0
57 B 21ms
19ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOCS3EBxjLuNF-3dResROPrw6rzxNB4HPAbqUHewPhG1yDzRp84EmX1HcCdGsQpHY7qPVNSQig9mF-zRDUDXYQbMH5rhQRODqe1bGzVrKHRx0GcKpfLTrrOY1PP_oM-oxtpd_T5FaIXTPiQ4fPfIMnzqD3bA3wNI1CAOLDwSFCddSl9vOtLXafsYOU5dos_w8w80-nV4ahTasdn5oMptPEXt0kx9Vor3R5JvZpxpjLf6mr9LaO4nQYyyS4U4q25obiT1I&sig=Cg0ArKJSzHgRL_UXkrU3EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 2891 26 KB
8 KB 11ms
9ms Script
text/javascript 2.19.38.84
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-38-84.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=4343
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Fri, 13 Sep 2019 13:13:26 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2891 75 KB
28 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 2891 307 KB
103 KB 11ms
11ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 9F8D 0
57 B 23ms
20ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuRm6VyNgH5IvOQshAxkg4bsbRPOtyOh9CLIgGZY-fIbg_srcCgXjboIEWB3tSKH8Nr1OTwa7w0f24CVKMW04BXKv7e5jq8z87hpZZvP8j-hnmhxSjNuMSFAYfIeYF1xbMHRkDvHtwSPXBHNyYgyQg_tjLOS2Re6vljKpxbDjxudPohzALUgOE8LM4syooOAYjIOAASAUw7lHN_4-WckL05K6sU0jRqg_QVv_Ph7X2ujZxHBOWfstmPxsX0HEUtIRK_-UnMpvZU&sig=Cg0ArKJSzMnj1n4hP-fkEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:03 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK adKit.min.js Show response
rev.cbsi.com/common/js/ Frame 9F8D 6 KB
2 KB 160ms
12ms Script
application/x-javascript 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?856579574
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 May 2019 18:29:20 GMT
Server: Apache
ETag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9F8D 75 KB
28 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 9F8D 307 KB
103 KB 8ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60576
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 711E 2 KB
1 KB 97ms
61ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.7373676600571755&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 5beed9122f1ef90478c7feb439906e93dc2896604e4f48f24c7403f26cf37f29

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=441
Content-Length: 910
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 10C4 2 KB
1 KB 89ms
55ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.927096606571131&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: d77c635a1a13072d6e85d634fb142067aa1cec79e9384807af1e556ed86d0c05

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=326
Content-Length: 913
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame E8E5 2 KB
1 KB 130ms
96ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4179042766498231&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 2aae3b67c345f508467d56bbb14ffc2e62e24e60a868b4d62a72c9a992954263

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=298
Content-Length: 915
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 459B 2 KB
1 KB 106ms
85ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.9960638379236486&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 598cfacb2986b2824cdea6498008b647ff7b9aaf6f72c30f990c513a3851c361

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=136
Content-Length: 917
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 2891 2 KB
1 KB 109ms
85ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.4084107942257833&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 80de6a7413a062cdb81ca1041af8eddaf5bbd9071142b590ab18ce3cd2f18615

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=447
Content-Length: 918
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 settings.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/f0e0ceb7-a6a0-48b5-992f-35aff4d1b4fe/ 8 KB
7 KB 18ms
18ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/f0e0ceb7-a6a0-48b5-992f-35aff4d1b4fe/settings.js?cb=637039077227986622
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b6a676ced219af0c45a7d7849b816ea45a70b873501f96281df006b378a1088

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: yrxD8m+5aFHYQcyCeYQ6zw==
age: 64943
cf-polished: origSize=8622
status: 200
last-modified: Thu, 12 Sep 2019 17:55:18 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: a393d39a-b01e-00d1-5693-69e89e000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 5159f6de1fbc5970-VIE
expires: Sat, 12 Sep 2020 12:01:03 GMT

GET
H2 200 lightbox_builder.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 4275 200 KB
27 KB 23ms
22ms Script
application/javascript 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637039077227986622
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: DPY02gsPpNVzBSyytYwMZw==
age: 65008
cf-polished: origSize=326600
status: 200
last-modified: Thu, 12 Sep 2019 17:55:22 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 34abaf0f-d01e-000d-2793-69bacd000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 5159f6de2fd05970-VIE
expires: Sat, 12 Sep 2020 12:01:03 GMT

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ Frame 2216 26 KB
12 KB 32ms
31ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?1382019
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Sep 2019 04:00:08 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=57545
Connection: keep-alive
Content-Length: 11933
Expires: Sat, 14 Sep 2019 04:00:08 GMT

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ Frame 2216 121 B
379 B 135ms
34ms Script
text/html 18.130.114.178
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=16&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568376063705&de=410780637383&m=0&ar=ab397f9-clean&q=2&cb=0&ym=0&cu=1568376063705&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1639013211&cs=0&callback=MoatSuperV26.gna340454
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.114.178 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-114-178.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 241104f5a0d61f4319f7d7d549bdbc49a68036de7785bdddc3eb12b619d61875

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Server: nginx
Etag: "8d51563dd974c42d3a387a6c614ba7a99fd1375e"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 121

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ 118 B
376 B 140ms
34ms Script
text/html 18.130.114.178
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=16&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568376063705&de=410780637383&m=0&ar=ab397f9-clean&q=3&cb=0&ym=0&cu=1568376063705&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1961942916&cs=0&callback=MoatDataJsonpRequest
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.114.178 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-114-178.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 19a1f60f62fc84dbc96d19186521eb5acc9c13fcc76382bf13ca37c9c2ad2f13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Server: nginx
Etag: "25cca07ded2e361db4a302db5a08ac7bdce83204"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 118

POST
H2 200 /
www.facebook.com/tr/ Frame 4D0B 0
0 6ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 6653
pragma: no-cache
cache-control: no-cache
origin: https://www.zdnet.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: fr=0AIv1VuNmGVLeMVQM..Bde4T_...1.0.Bde4T_.
Origin: https://www.zdnet.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
content-type: text/plain
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0
server: proxygen-bolt
date: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 10C4 67 KB
25 KB 21ms
17ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.927096606571131&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 25845
x-xss-protection: 0
server: cafe
etag: 13217402123377493596
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK c503014e-8aff-4740-9273-61956caff97d
beacon-eu2.rubiconproject.com/beacon/d/ Frame 10C4 43 B
268 B 49ms
15ms Image
image/webp 69.173.144.152
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/c503014e-8aff-4740-9273-61956caff97d?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B53A1F29D6F2609A11AE79B78C158256DF4AB97512BD42DDA027FD5771AFCD31ACCF9979FF1AA8729172DB22D3B21A9B5BDB7708555160FA55595FFD595AF15CD3A7D0F4B29A162671C45189F33B502F0956270D897C40F9B96B8F425CDA5648290E385F9572B9DD5BB4F33CDE214CF90
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 711E 67 KB
25 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.7373676600571755&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 25845
x-xss-protection: 0
server: cafe
etag: 13217402123377493596
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK dce86cbe-7b45-4051-9777-1352ac9afa13
beacon-eu2.rubiconproject.com/beacon/d/ Frame 711E 43 B
268 B 53ms
18ms Image
image/webp 69.173.144.152
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/dce86cbe-7b45-4051-9777-1352ac9afa13?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B9E8BF237A3D11DBB26D671C1D36F5CECF7710514C90840509241C023DD91DC230818C23D25D1D235172DB22D3B21A9B5F1CD33B98BB0A1845595FFD595AF15CD3A7D0F4B29A162671C45189F33B502F0956270D897C40F9B96B8F425CDA5648290E385F9572B9DD5BB4F33CDE214CF90
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 9F8D 40 KB
12 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?856579574

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

cafcc9a51d760f8caf35209bffaa361d8be982ef5018292042d789b8433dd2b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "277 / 698 of 1000 / last-modified: 1568323734"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 12668
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame E8E5 67 KB
25 KB 20ms
18ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4179042766498231&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 25845
x-xss-protection: 0
server: cafe
etag: 13217402123377493596
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK ed9ba1b6-1b86-4d16-8408-1715be60842e
beacon-eu2.rubiconproject.com/beacon/d/ Frame E8E5 43 B
268 B 50ms
19ms Image
image/webp 69.173.144.152
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/ed9ba1b6-1b86-4d16-8408-1715be60842e?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B993356D369BD3959E336FAE6651607747E56547D6E1C6E850F0C4035560567E4B06000CD1FA55786E4A9AFA6E089EF84BD7E53D087B645325595FFD595AF15CD3A7D0F4B29A162671C45189F33B502F0956270D897C40F9B96B8F425CDA5648290E385F9572B9DD5BB4F33CDE214CF90
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 459B 67 KB
25 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.9960638379236486&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 25845
x-xss-protection: 0
server: cafe
etag: 13217402123377493596
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK 16cd7e0d-b1fd-4b19-bc4c-2a2276762e6f
beacon-eu2.rubiconproject.com/beacon/d/ Frame 459B 43 B
268 B 50ms
20ms Image
image/webp 69.173.144.152
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/16cd7e0d-b1fd-4b19-bc4c-2a2276762e6f?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B34E54AC3B31FF60B49AE6E8B50639AAF98E6C2C4C8A3536180E713DE39ABB16371B5A5AB22369783E4A9AFA6E089EF847B66E4144C0B112BBFF2EE33D6DED53A3570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCFEB2496EFCC5E65F183009FDB9DE7981633F8630F2FDB6069
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 2891 67 KB
25 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.4084107942257833&tk_st=1&rf=https%3A//www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 25845
x-xss-protection: 0
server: cafe
etag: 13217402123377493596
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK d085fdf0-2201-4e05-8b2d-e78975f6301b
beacon-eu2.rubiconproject.com/beacon/d/ Frame 2891 43 B
268 B 56ms
19ms Image
image/webp 69.173.144.152
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/d085fdf0-2201-4e05-8b2d-e78975f6301b?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BB87F4D4729F22BD9BBC9A57805505262E2D94DF47C6C9C277A6F6A367B4A344350FF7E7AC4E51AA7172DB22D3B21A9B5F85DBD94AD24765ABFF2EE33D6DED53A3570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF9339CFA995EA152083009FDB9DE7981633F8630F2FDB6069
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 glcfg510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/configs/ 2 KB
1 KB 7ms
5ms Script
application/javascript 2600:9000:2057:6800:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: .dtx57my2OREzULNOzccgPn4wUjEtWqi
content-encoding: gzip
last-modified: Mon, 12 Aug 2019 17:38:40 GMT
server: AmazonS3
age: 3218
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Fri, 13 Sep 2019 11:33:50 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: gyzPrHb6FRLWn6Ziq0NO4-AmFLRf1ZttxSBJhw1JYEUXiTDcLpkcKg==
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 37ms
36ms XHR
application/json 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1568376063892
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f849f991a317721d9faba309ac3d3ca2f571e171832b52d3ed77d72e1dc0a0b0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v042-07e3c531b.edge-irl1.demdex.com 5.59.0.20190904135845 6ms (+0ms)
Pragma: no-cache
Content-Encoding: gzip
X-Error: 300,300
X-TID: HQSVu3a0RiM=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 673
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://www.zdnet.com

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 36A8CE_2_0.woff2
vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/ 53 KB
54 KB 19ms
7ms Font
binary/octet-stream 151.101.114.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/36A8CE_2_0.woff2
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:03 GMT
via: 1.1 varnish, 1.1 varnish
age: 139588
x-cache: HIT, HIT
status: 200
content-length: 54767
x-amz-id-2: MB4kz71c4pCgKqmbxlPCRwopnXgRkM+K6PNPBZydd9jschWqEK3QWyQXFkKNxNrVPNecOxrwKKc=
x-served-by: cache-dca17720-DCA, cache-hhn4056-HHN
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1568376064.948630,VS0,VE0
etag: "22d779c809ed11e380d62c76e1f202e8"
access-control-max-age: 3600
x-amz-request-id: 3ADB3AE2E6D210C6
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 157, 229

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ Frame 9F8D 119 B
377 B 35ms
35ms Script
text/html 18.130.114.178
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=15&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568376063957&de=218213930339&m=0&ar=ab397f9-clean&q=7&cb=0&ym=0&cu=1568376063957&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1235709343&cs=0&callback=MoatSuperV26.gna285509
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.114.178 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-114-178.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 8ad1ba3248ecb0bec23a5d6496c457c07c73dca7d2c350a30cf2bb74a185018b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:03 GMT
Server: nginx
Etag: "90fde014e3c422db51fd6e80d851781c6a1e5b35"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 119

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 24ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&cm=15&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1568376063957&de=218213930339&m=0&ar=ab397f9-clean&q=9&cb=0&ym=0&cu=1568376063957&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=170499&na=1603762894&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:03 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:03 GMT

GET
H/1.1 200
OK id Show response
saa.cbsi.com/ 90 B
713 B 96ms
95ms XHR
application/x-javascript 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=55741767664217319690087456407840144009&ts=1568376063989
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: ebca949f04795223add59d5c38f384f78ec91f9119be58ef80cb207db692efd6

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Fri, 13 Sep 2019 12:01:04 GMT
Server: Omniture DC
xserver: www127
Vary: Origin
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: https://www.zdnet.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 90

GET
H2 200 bridge3.330.0_en.html
imasdk.googleapis.com/js/core/ Frame 81D5 0
0 6ms
5ms Document
text/html 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.330.0_en.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.330.0_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 192588
date: Thu, 12 Sep 2019 13:28:00 GMT
expires: Fri, 11 Sep 2020 13:28:00 GMT
last-modified: Wed, 11 Sep 2019 16:00:42 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 81184
alt-svc: quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 26 KB
10 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:80b::2006
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 10523
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 / Show response
www.zdnet.com/video/related-videos-xhr/this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history/ 34 KB
6 KB 925ms
923ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/video/related-videos-xhr/this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2f836c619ecf6843eaa3a85b450ad94b77e77c6812eef56edf46d99193ffe184

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 5334
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Sep 2019 12:01:04 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:04 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 8249ff61-fb44-4147-9f56-6f779b773c30
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 13 Sep 2019 13:31:04 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 89ms
88ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthis-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8&i=Monokle%3A%20The%20007%20of%20spying%20malware&g0=security&g1=catalin%20cimpanu&u=C4Y0Sg289yABs4H9h&t=DulilUBIZulmy2zHJBFfzwUC2hoaW&x=0&y=0&V=116&VS=VS&n=1&b=2843&r=&_vd=56000&_vi=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&_vh=zdnet.com&_pu=mZZ5IyvxI4T60Xy&_pt=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0&W=0&R=0&I=1&E=0&j=75&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 37ms
36ms XHR
application/json 34.247.192.223
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=55741767664217319690087456407840144009&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012EBDC280052CD07F-600029AFE00AFDB3&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1568376064142
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.192.223 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-247-192-223.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8996411a026e31550ae9d27591f1215bd2fde494419437c968ac3db5f1743926

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v042-0965b5a37.edge-irl1.demdex.com 5.59.0.20190904135845 7ms (+0ms)
Pragma: no-cache
Content-Encoding: gzip
X-Error: 300,300
X-TID: xXIoU7U5Ru8=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 673
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 459B 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 459B 109 B
171 B 17ms
16ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 459B 222 KB
82 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 7F3E 222 KB
82 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/ Frame EE30 0
0 19ms
2ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20190911/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 12 Sep 2019 14:02:12 GMT
expires: Thu, 26 Sep 2019 14:02:12 GMT
content-type: text/html; charset=UTF-8
etag: 14866779439905550351
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 7273
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 79132
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 893B 0
0 64ms
7ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 11 Sep 2019 18:26:58 GMT
Content-Encoding: gzip
Content-Length: 7616
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=58968
Expires: Sat, 14 Sep 2019 04:23:52 GMT
Date: Fri, 13 Sep 2019 12:01:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 10C4 109 B
171 B 21ms
13ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 10C4 109 B
171 B 22ms
14ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 10C4 222 KB
82 KB 40ms
32ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame B644 0
0 25ms
12ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 11 Sep 2019 18:26:58 GMT
Content-Encoding: gzip
Content-Length: 7616
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=58968
Expires: Sat, 14 Sep 2019 04:23:52 GMT
Date: Fri, 13 Sep 2019 12:01:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 2891 109 B
171 B 23ms
23ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2891 109 B
171 B 21ms
21ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 2891 222 KB
82 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 2C66 0
0 23ms
13ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 11 Sep 2019 18:26:58 GMT
Content-Encoding: gzip
Content-Length: 7616
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=58968
Expires: Sat, 14 Sep 2019 04:23:52 GMT
Date: Fri, 13 Sep 2019 12:01:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 711E 109 B
171 B 27ms
18ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 711E 109 B
171 B 28ms
0ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 711E 222 KB
82 KB 31ms
20ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 8874 222 KB
82 KB 64ms
38ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 55C6 0
0 6ms
6ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 11 Sep 2019 18:26:58 GMT
Content-Encoding: gzip
Content-Length: 7616
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=58968
Expires: Sat, 14 Sep 2019 04:23:52 GMT
Date: Fri, 13 Sep 2019 12:01:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame E8E5 109 B
171 B 31ms
31ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame E8E5 109 B
171 B 34ms
33ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame E8E5 222 KB
82 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 84018
x-xss-protection: 0
server: cafe
etag: 7346031692830552506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 4FBC 0
0 13ms
6ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 11 Sep 2019 18:26:58 GMT
Content-Encoding: gzip
Content-Length: 7616
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=58968
Expires: Sat, 14 Sep 2019 04:23:52 GMT
Date: Fri, 13 Sep 2019 12:01:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 9F8D 109 B
171 B 37ms
16ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 9F8D 109 B
171 B 34ms
14ms Script
application/javascript 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019082901.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 9F8D 158 KB
58 KB 33ms
13ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082901.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

ec6c461b6a7da1d28c5bb10b93c755c080ccdaed59821bdf1076bdc3866cc956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 29 Aug 2019 13:06:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 59716
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4275 2 KB
487 B 19ms
19ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway|Exo+2

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637039077227986622

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

d0a92a71ae2369c66c9138de52438cbf42b9338d45916089bc1d5f38bd4d65da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 13 Sep 2019 12:01:04 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 13 Sep 2019 12:01:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
DATA 200
OK truncated
/ Frame 711E 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf690eaccbac5e985eacbaafd7610c9c6984f43cd3a872680f7b1f43af31b278

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 10C4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2eb295ab1538aea6c5abf5d22c90ed13f1a50ea7b4961a0e8fe3b0052ce424d7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E8E5 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c85fcba7deba2ffcb224f52e62ab32c6d5db3310c0e5d1939fdc4554aa77865

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 459B 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b885bae17502c4943f5917b72d2c74e7ffd4783a053f2264a5ccbb305cd7584

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2891 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ee2cc34755627fb82cb15d9ce3f00fe9fac8111052f5ec56e35ae71739d11fa

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 PF7B87067-BF4D-F80F-E040-070AAD316CE6.js Show response
cdn-gl.imrworldwide.com/conf/ 41 KB
8 KB 8ms
7ms Script
application/javascript 2600:9000:2057:6800:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6127975ef8fa442963a10bf206a986d9e78cc0a802bc0062f9e3369ad36eff83

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: Qg6HvYbYyhAEOAkCuC.HhvdzgBVhT9SS
content-encoding: gzip
last-modified: Thu, 01 Aug 2019 15:58:46 GMT
server: AmazonS3
age: 2421
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400,s-maxage=86400
date: Fri, 13 Sep 2019 11:20:44 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Y1j3QSpNAZJd6u-ko9iruGSfYXtjl31b3YRhG2UVCfP8cEYQ7A8gig==
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)

GET
H2 200 fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/ 1 KB
2 KB 41ms
12ms Image
image/png 2a04:4e42:3::621
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637039077235229344

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
status: 200
etag: W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
date: Fri, 13 Sep 2019 12:01:04 GMT
accept-ranges: bytes
timing-allow-origin: *
content-length: 1362
x-served-by: cache-ams21048-AMS, cache-fra19122-FRA

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 33ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=21&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1568376064724&r=556242103906&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 39ms
13ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=21&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1568376064724&r=556242103906&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame 4275 13 KB
13 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway|Exo+2
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 25 Aug 2019 01:25:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 1679727
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13428
x-xss-protection: 0
expires: Mon, 24 Aug 2020 01:25:37 GMT

GET
H2 200 7cHmv4okm5zmbtYoK-4W4nIp.woff2
fonts.gstatic.com/s/exo2/v6/ Frame 4275 13 KB
13 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/exo2/v6/7cHmv4okm5zmbtYoK-4W4nIp.woff2

Requested by

Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4b4a1db2b64f0618827c21c3c01038cdb1f1618fcd9c727676c323f9d286185b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway|Exo+2
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Sep 2019 12:46:42 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jul 2019 23:53:27 GMT
server: sffe
age: 947662
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13408
x-xss-protection: 0
expires: Tue, 01 Sep 2020 12:46:42 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 16ms
15ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=9&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064799&r=711460839571&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 16ms
16ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=9&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064799&r=711460839571&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 24ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=9&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064799&r=711460839571&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
8ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463498&S1id=23605329&S2id=23619609&ord=1568376064855&r=31218209698&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 9ms
9ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463498&S1id=23605329&S2id=23619609&ord=1568376064855&r=31218209698&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1568376064890&r=8077827291&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1568376064890&r=8077827291&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 10ms
9ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1568376064890&r=8077827291&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
8ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064921&r=283476752765&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=middle&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=7&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064921&r=283476752765&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=middle&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:04 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:04 GMT

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
296 B 30ms
30ms Image
image/gif 2606:4700::6810:50a5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1568376064947&h=www.zdnet.com&e=i&u=40913&b=165196&v=empty&s=empty
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2019 12:01:04 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 622791
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5159f6e60d025970-VIE
cf-bgj: imgq:85

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 83CB 0
0 234ms
233ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064167&bpp=36&bdt=710&fdt=791&idt=791&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&rume=1&frm=23&ife=5&pv=2&ga_vid=1508440188.1568376065&ga_sid=1568376065&ga_hid=2003191431&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2430&biw=1585&bih=1200&isw=300&ish=250&ifk=3748784076&scr_x=0&scr_y=0&eid=21060549&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.2u5sgg4f69uz&fsb=1&dtd=821

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064167&bpp=36&bdt=710&fdt=791&idt=791&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&rume=1&frm=23&ife=5&pv=2&ga_vid=1508440188.1568376065&ga_sid=1568376065&ga_hid=2003191431&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2430&biw=1585&bih=1200&isw=300&ish=250&ifk=3748784076&scr_x=0&scr_y=0&eid=21060549&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.2u5sgg4f69uz&fsb=1&dtd=821
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 13 Sep 2019 12:01:05 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 459B 76 KB
28 KB 44ms
40ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 842B 0
0 104ms
104ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162154&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064206&bpp=50&bdt=818&fdt=817&idt=817&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=168651392.1568376065&ga_sid=1568376065&ga_hid=289900991&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=3566962586&scr_x=0&scr_y=0&eid=20199335&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.f4jvwiiicb6j&fsb=1&dtd=823

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162154&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064206&bpp=50&bdt=818&fdt=817&idt=817&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=168651392.1568376065&ga_sid=1568376065&ga_hid=289900991&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=3566962586&scr_x=0&scr_y=0&eid=20199335&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.f4jvwiiicb6j&fsb=1&dtd=823
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 13 Sep 2019 12:01:05 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 10C4 76 KB
28 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 9299 0
0 83ms
82ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224024&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064262&bpp=19&bdt=782&fdt=773&idt=773&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=94586948.1568376065&ga_sid=1568376065&ga_hid=1789786944&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3426&biw=1585&bih=1200&isw=728&ish=90&ifk=80841140&scr_x=0&scr_y=0&eid=20199335%2C368226500&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.kvzuq9qyzvlz&fsb=1&dtd=780

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224024&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064262&bpp=19&bdt=782&fdt=773&idt=773&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=94586948.1568376065&ga_sid=1568376065&ga_hid=1789786944&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3426&biw=1585&bih=1200&isw=728&ish=90&ifk=80841140&scr_x=0&scr_y=0&eid=20199335%2C368226500&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.kvzuq9qyzvlz&fsb=1&dtd=780
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 13 Sep 2019 12:01:05 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2891 76 KB
28 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 884C 0
0 102ms
101ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162155&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064287&bpp=42&bdt=914&fdt=790&idt=790&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=1440463021.1568376065&ga_sid=1568376065&ga_hid=925113771&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1007310051&scr_x=0&scr_y=0&eid=20199336%2C20040010&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.7xwvs5foo9qk&fsb=1&dtd=799

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162155&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064287&bpp=42&bdt=914&fdt=790&idt=790&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=1440463021.1568376065&ga_sid=1568376065&ga_hid=925113771&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1007310051&scr_x=0&scr_y=0&eid=20199336%2C20040010&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=4066913089&ifi=1&uci=1.7xwvs5foo9qk&fsb=1&dtd=799
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 13 Sep 2019 12:01:05 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 711E 76 KB
28 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 17ms
16ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=367&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1568376064724&r=556242103906&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F8D 32 KB
8 KB 109ms
109ms XHR
text/plain 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4133335756786616&correlator=4400652660646276&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=21064546&vrg=2019082901&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190913&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3Daab7e17d-2bcd-45fa-9c2f-40266416e46d%7Cenv%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3Daab7e17d-2bcd-45fa-9c2f-40266416e46d&cookie=ID%3Dc5080aa238293b12%3AT%3D1568376062%3AS%3DALNI_MZbS0iJ5Ucak-g1Zbkt2wlcGQCZ7w&cdm=www.zdnet.com&bc=31&lmt=1568376065&dt=1568376065133&dlt=1568376063488&idt=1624&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=4d2m7xv96b0e%7C3mxq5si5rlsn&ifi=1&ifk=3616802994&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&dssz=17&icsg=43552&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&blev=1&bisch=1&ga_vid=434044161.1568376065&ga_sid=1568376065&ga_hid=836154269&fws=384%2C384&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

30d28f4d2f587fc144126c6f1045d16cef7213c965c3c7183bb17b32fd4e3da1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 7662
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239375540,138239479696
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019082901.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 9F8D 66 KB
25 KB 14ms
14ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082901.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

05e529a757d25aa9d160d28e57c20041eee3f973870c0f0ad4ac7c21937254b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 29 Aug 2019 13:06:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 25315
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 9F8D 0
0

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 1043 0
0 129ms
129ms Document
text/html 2a00:1450:4001:818::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064351&bpp=14&bdt=955&fdt=818&idt=818&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=75661714.1568376065&ga_sid=1568376065&ga_hid=1521471590&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1455&biw=1585&bih=1200&isw=300&ish=250&ifk=3638436589&scr_x=0&scr_y=0&eid=20199335%2C21064339&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.y1sok0efbdnt&fsb=1&dtd=827

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&ea=0&flash=0&wgl=1&dt=1568376064351&bpp=14&bdt=955&fdt=818&idt=818&shv=r20190911&cbv=r20190131&saldr=sa&correlator=6311985224104&frm=23&ife=5&pv=1&ga_vid=75661714.1568376065&ga_sid=1568376065&ga_hid=1521471590&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1455&biw=1585&bih=1200&isw=300&ish=250&ifk=3638436589&scr_x=0&scr_y=0&eid=20199335%2C21064339&oid=3&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=3832671437&ifi=1&uci=1.y1sok0efbdnt&fsb=1&dtd=827
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnzBiwjMMPlhlpIdVs9z8cxPHPbfQCSRv7xFkf0B7X7I8lwBATEN23TWfBj
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 13 Sep 2019 12:01:05 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame E8E5 76 KB
28 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 a-chinese-apt-is-now-going-after-pulse-s-5d77cb0c8fd9770001923d3f-1-sep-11-2019-20-37-58-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/11/5d8d8466-5bf8-4b01-b91e-36f2023b0fe5/thumbnail/170x96/ae7370e22d231fbbbb7df0ab23bab1f4/ 873 B
758 B 6ms
4ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/11/5d8d8466-5bf8-4b01-b91e-36f2023b0fe5/thumbnail/170x96/ae7370e22d231fbbbb7df0ab23bab1f4/a-chinese-apt-is-now-going-after-pulse-s-5d77cb0c8fd9770001923d3f-1-sep-11-2019-20-37-58-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

849a44adfb87a4af1929bb320afc6ed24987d1bb1b587f42fa302f94f3da4741

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91244
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 652
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "98d6f58ab0dafbb86b083a001561bb34"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 cybersecurity-clicking-email-links-could-5d7772bc26d15a0001ff40bc-1-sep-10-2019-11-53-23-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/10/aa1ef608-7239-4ab0-8603-4c9dcb2a0f79/thumbnail/170x96/800959bf2c63b7190dc3289c7f3cbd9b/ 4 KB
4 KB 8ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/10/aa1ef608-7239-4ab0-8603-4c9dcb2a0f79/thumbnail/170x96/800959bf2c63b7190dc3289c7f3cbd9b/cybersecurity-clicking-email-links-could-5d7772bc26d15a0001ff40bc-1-sep-10-2019-11-53-23-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2dd79636c16cdb934371ddaa3aa98eb9fb083ccd3d58668fb499944b133fe98d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165007
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3716
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d3802b1dc0d80d8a3c8ccc6ccc068e7c"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 brazilian-citizen-data-under-threat-with-5d7634b226d15a0001fec451-1-sep-09-2019-11-20-40-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/09/808b7de8-1f2b-436f-ba65-c3fe9e2afad4/thumbnail/170x96/fa04fb5d704123a090367e80ccf0d03c/ 4 KB
4 KB 9ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/09/808b7de8-1f2b-436f-ba65-c3fe9e2afad4/thumbnail/170x96/fa04fb5d704123a090367e80ccf0d03c/brazilian-citizen-data-under-threat-with-5d7634b226d15a0001fec451-1-sep-09-2019-11-20-40-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f5a884d361385fcd5e67211dc4a330e091df8d28b280f6211cca2ae8b3439ed8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 323392
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3889
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "4fc848051e4459b8a6afeb210c3664ec"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bec-overtakes-ransomware-and-data-breach-5d6e5d8a8fd97700018f4da2-1-sep-09-2019-11-14-11-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/09/0ea4fa30-66cc-43fc-9361-bccbfcf79d80/thumbnail/170x96/c6e054912f2bab1eb5ff7c0e594b0d5b/ 4 KB
4 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/09/0ea4fa30-66cc-43fc-9361-bccbfcf79d80/thumbnail/170x96/c6e054912f2bab1eb5ff7c0e594b0d5b/bec-overtakes-ransomware-and-data-breach-5d6e5d8a8fd97700018f4da2-1-sep-09-2019-11-14-11-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f9ff6361605f3eb574a6877aa22c0450c88451740cc98bd26c9401da9bf4794a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 334771
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4453
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "61bdf049525b7d4c2cf79257ec7c2c56"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 accc-seeks-changes-to-data-privacy-laws-5d71c17d8fd977000190aecf-1-sep-06-2019-4-26-54-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/06/bacc9eab-8d53-4c7a-8ee0-e3f14b989024/thumbnail/170x96/d5231097a9ea592960f1447b3e95836d/ 6 KB
6 KB 10ms
8ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/06/bacc9eab-8d53-4c7a-8ee0-e3f14b989024/thumbnail/170x96/d5231097a9ea592960f1447b3e95836d/accc-seeks-changes-to-data-privacy-laws-5d71c17d8fd977000190aecf-1-sep-06-2019-4-26-54-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e4a5264d954871f64c3d8edd2f4dc040fe2c1cc8c02d157f715d073f07ef76b4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 374249
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5893
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "05ae14d7ae387b93370d142d82220f1b"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 android-google-play-app-with-100-million-5d6ceebba88d300001f1746a-1-sep-03-2019-20-53-42-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/03/93f26f1d-2484-44ae-b379-2e0b6a95c777/thumbnail/170x96/11b7be1233bed224fbe9f722fcb9c6df/ 3 KB
3 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/03/93f26f1d-2484-44ae-b379-2e0b6a95c777/thumbnail/170x96/11b7be1233bed224fbe9f722fcb9c6df/android-google-play-app-with-100-million-5d6ceebba88d300001f1746a-1-sep-03-2019-20-53-42-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

95a8a0d7c4be2d9e6c9e3e994ee135247f077ff6f2d1919aea45f4a6c2aba7b3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744610
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3145
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "b299ad862b6f12cb57679f0538eca514"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 android-security-are-you-using-these-pop-5d6d1528a88d300001f18c9f-1-sep-03-2019-21-01-49-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/03/84652fcd-4cd8-4b40-a2d8-154a0ffb1f67/thumbnail/170x96/e051e3125bd484b6792f8ebdd0e0949b/ 3 KB
3 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/03/84652fcd-4cd8-4b40-a2d8-154a0ffb1f67/thumbnail/170x96/e051e3125bd484b6792f8ebdd0e0949b/android-security-are-you-using-these-pop-5d6d1528a88d300001f18c9f-1-sep-03-2019-21-01-49-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1e136ad5006832ad9ffc64d8f28eae6ddc9d8ec274145284158f99a93d35c9fa

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 756613
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3122
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "1160453108d3e537255e9f7b931f4e90"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 thumb.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/03/273d7698-a3f0-463d-bb32-34601c2293bb/thumbnail/170x96/6746e0b66d573ee78b4e396b8d58a865/ 7 KB
7 KB 6ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/03/273d7698-a3f0-463d-bb32-34601c2293bb/thumbnail/170x96/6746e0b66d573ee78b4e396b8d58a865/thumb.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

aaf88fe86c40b3cea4d37f2f787ada13107960700ca77a6325523acad9ee5cf4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 838194
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6644
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "464074179972cbbd75a39abc6954cd12"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 hong-kong-isps-oppose-any-government-pla-5d6c5b50b987f600017bf160-1-sep-02-2019-1-54-23-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/02/f2944792-3c6b-48c1-9125-7f82ea196413/thumbnail/170x96/5b315cf2a5ed093fc6e713870d7ae8c0/ 5 KB
5 KB 6ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/02/f2944792-3c6b-48c1-9125-7f82ea196413/thumbnail/170x96/5b315cf2a5ed093fc6e713870d7ae8c0/hong-kong-isps-oppose-any-government-pla-5d6c5b50b987f600017bf160-1-sep-02-2019-1-54-23-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fd5258a015fd9426f6e30d9e6c27a8531b09c74a63979e991f23ae2749dd7e2f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 883481
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4969
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "124c3e4ada4a529aa0fedece80bb42ab"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 canberra-to-create-cyber-and-ip-taskforc-5d6c4f7aa88d300001f15320-1-sep-02-2019-24-58-24-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/02/367312d4-7ea4-4c1f-bfe6-b85bbdba6771/thumbnail/170x96/3eec44a2cd2d4cb029c252a11e15453f/ 4 KB
5 KB 9ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/02/367312d4-7ea4-4c1f-bfe6-b85bbdba6771/thumbnail/170x96/3eec44a2cd2d4cb029c252a11e15453f/canberra-to-create-cyber-and-ip-taskforc-5d6c4f7aa88d300001f15320-1-sep-02-2019-24-58-24-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f9071c0948e76f860b54b70d2b49f0ccf6802d581db04131b4b4d955dde43a6b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 889271
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4517
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "78f1893678afbeaa90b1fa01b9cfb860"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 9ms
8ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=400&fi=1&apd=404&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064799&r=711460839571&t=hdn&os=1&fi2=0&div1=0&ait=198&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=348&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463498&S1id=23605329&S2id=23619609&ord=1568376064855&r=31218209698&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 91ms
91ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&u=mZZ5IyvxI4T60Xy&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.06&x=0&m=0&y=3841&o=1585&w=1200&j=30&R=1&W=0&I=0&E=3&e=3&r=&b=2279&t=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&V=116&tz=-120&_acct=anon&_vi=Monokle%3A%20The%20007%20of%20spying%20malware&_vp=/video/manifest/this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8&_vdd=video%40zdnet.com&_vs=s1&_vt=ct&_vtn=null&_vd=56000&sn=2&sv=ChK7C6G2T-TVWXwYCNxQ6nqcexf&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:05 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 15ms
15ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=338&fi=1&apd=341&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1568376064890&r=8077827291&t=hdn&os=1&fi2=0&div1=0&ait=168&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 nlsSDK600.bundle.min.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 159 KB
46 KB 8ms
8ms Script
application/javascript 2600:9000:2057:6800:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: LsknotgJ27sHWfh0olFMGPF0aUHXxFfq
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 15:40:32 GMT
server: AmazonS3
age: 908
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Fri, 13 Sep 2019 11:50:23 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: T8f7sWlm72Ijy3ZpWoZVxeRSDufXzC7hzdWdNVOgEalvKz5XummPvw==
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=344&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064921&r=283476752765&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=middle&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 carousel-f3b9253e16-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 312 B
323 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/carousel-f3b9253e16-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593348
status: 200
vary: Accept-Encoding
content-length: 215
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc8c9-138"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Sep 2019 15:11:55 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame BBC2 0
57 B 17ms
17ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst4LliQjREH13lGjnhtf64sttNUv6xWkxND33hmwNShUVuXpYsDeAvIQrVlJUKh5AJdCXANnF3o0L81EZkHGOCCxia1uniETWMUGxQH7NmWSYuzM5t_aRzhLNBbLvnpJJW5TF0gGr2ubbrhcWYO6VxP-HsXvHvXX-89Iri3JfSSjMyZ2iXS3MowFkuvuaeN05wZqLi7Qo28f5X9wXURwnfu-0ZmVXi96PPudfCp9GTlIO0pVNjePPFpebRa00eEOYL3dLsrciBo&sig=Cg0ArKJSzINw8ePVp70vEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:05 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame BBC2 75 KB
28 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame BBC2 307 KB
103 KB 11ms
10ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082901.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:05 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60574
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 5E85 0
48 B 19ms
19ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstS8uxuwcQ_OUPn5Pjqw20qNE3mT2OSrEhIqreGqrSdLPIKKYgz9ygscw5ztGgxcZxAwIJjSzcxFhGV6zrtRg9wdx5uOdeAW6Q4TppqW4EDGsoWkAA87o6yc7hBBMdotY7HYBBHoTTYWicKuktkvosVGDTUDpScvXVP-bH0DaNO-6o_nRNvXcjiIv5QS4fYdBR45_nE0ek2ZAwUPmiB6vjTVQVvh42-PKDtHf6YjeQnldV6ij0L2zch43FIKEcn2qcsjS8xJ6A4&sig=Cg0ArKJSzDp8Q1ATRhwuEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:05 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5E85 75 KB
28 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 5E85 307 KB
103 KB 6ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019082901.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:05 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60574
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9F8D 76 KB
28 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019082901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28408
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 7E0D 0
0 7ms
7ms Document
text/html 2600:9000:2057:6800:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: cdn-gl.imrworldwide.com
:scheme: https
:path: /novms/html/ls.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 200
content-type: text/html
last-modified: Mon, 12 Aug 2019 17:38:40 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 1SR6kNxKWnz4xgTszjGjxW9zbX6Jzg9u
server: AmazonS3
content-encoding: gzip
date: Fri, 13 Sep 2019 11:29:52 GMT
cache-control: max-age=86400
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: hxtqIVBFl1Q76Ug-iCV9CCTuZrKQvmu5Kq5ujIflu7KZUVdolFLNpQ==
age: 1923

GET
H2 200 carousel-1.0.js Show response
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/ 21 KB
4 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/carousel-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72707
status: 200
vary: Accept-Encoding
content-length: 4361
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:20:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1c05-5590"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 15:49:18 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame BBC2 49 KB
19 KB 5ms
5ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

9b404c617f947b58e4c257e9d622512567b05283f1ce4894b11273982c534f71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 11:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3050
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 19002
x-xss-protection: 0
server: cafe
etag: 16639907700459338416
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:10:15 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 5E85 49 KB
19 KB 6ms
5ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

9b404c617f947b58e4c257e9d622512567b05283f1ce4894b11273982c534f71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 11:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3050
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 19002
x-xss-protection: 0
server: cafe
etag: 16639907700459338416
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 13 Sep 2019 12:10:15 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BBC2 0
56 B 164ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k0i2m5fi&chm=1&ctx=2&qqid=CMLr85HgzeQCFcg24Aodk3IIYQ&met.4=fb.5~lb.6p~ol.8b~idt.11h~dt.-7n&met.3=197.69~123.68_1~118.7s_1~117.8b~118.8d~118.93~118.98~118.99~118.a7~113.an_5~112.am_6~118.at&met.1=1.k0i2m54w~14.0~15.0~16.0~17.0~18.0~19.0~20.8b~21.8c&met.7=CCIQBBgBIAUoBTAXOBJoBnAXeDmwAQG4AQM~CCoQChgBIAYoBjAxOCs~CBsQCiAHOBU~CCgQChgBIMkCKMkCMM8COAZoygJwzwJ47pUBgAG6lAGIAdGEA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:05 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5E85 0
56 B 163ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k0i2m5fw&chm=1&ctx=2&qqid=CMPr85HgzeQCFcg24Aodk3IIYQ&met.4=fb.3~lb.6l~ol.8k~idt.118~dt.-7w&met.3=197.6k~123.6j_2~118.7k~118.85~117.8k~118.8u~118.90~118.90~118.9z_1~118.ak~113.ar_1~112.ar_1&met.1=1.k0i2m555~14.0~15.0~16.0~17.0~18.0~19.0~20.8j~21.8k&met.7=CCIQBBgBIAMoAzAWOBNoA3AWeDCwAQG4AQM~CCoQChgBIAMoAzAuOCs~CBsQCiAEOBE~CCgQChgBINkCKNkCMOACOAdo2QJw3wJ4hJUBgAG6lAGIAdGEA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:05 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content / Show response
686eb51b.akstat.io/ 0
354 B 200ms
187ms XHR
image/gif 104.108.48.32
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://686eb51b.akstat.io/?h.pg=article&when=1568376065864&cdim.Site_View=desktop&t_other=custom3%7C1826&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=438c4fd323fc6b11742d703f88d95de2093e3610&h.t=1568376063196&http.initiator=api&rt.start=api&rt.si=70c12a37-05c1-49e7-9cc9-460451977f7d&rt.ss=1568376065160&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.48.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-48-32.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Fri, 13 Sep 2019 12:01:06 GMT

POST
H/1.1 200
OK / Show response
inqlnfvog763mmf771rou737u.litix.io/ 43 B
349 B 90ms
90ms XHR
image/gif 107.23.109.48
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://inqlnfvog763mmf771rou737u.litix.io/
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.109.48 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-109-48.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Access-Control-Allow-Methods: POST, GET
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 404
Not Found OAS_Countdown_EG_5_700.webm
cbsadsales-a.akamaihd.net/Q1/ 16 B
184 B 324ms
286ms Media
text/html 2.16.186.88
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsadsales-a.akamaihd.net/Q1/OAS_Countdown_EG_5_700.webm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.88 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-88.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 16
Content-Type: text/html; charset=iso-8859-1

POST
H2 204 csi
csi.gstatic.com/ 0
56 B 164ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k0i2m5ia&c=6311985224104&slotId=3155992612052&met.4=hvd_lc.k0i2m5i9~hvd_src.k0i2m5ia
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:05 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=928&tet=1125&fi=1&apd=1129&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1568376064799&r=711460839571&t=iv&os=1&fi2=0&div1=1&ait=923&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 7ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=842&tet=1046&fi=1&apd=1049&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1568376064890&r=8077827291&t=iv&os=1&fi2=0&div1=1&ait=876&zMoatVGUID=aab7e17d-2bcd-45fa-9c2f-40266416e46d&zMoatCURL=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:05 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 13 Sep 2019 12:01:05 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 711E 42 B
178 B 17ms
16ms Image
image/gif 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstP7g9l1u1EQMHzC3pGXA--XiF_fTEumKJ-M2tb_2PeN75aB9DmBHe98_6UBayMsfp6QOhYYnDYkhhgfqaqsbh5mWHW6ZiC7wmB4SUBXX4&sig=Cg0ArKJSzO1esHDYzSDBEAE&adk=2600359504&tt=2498&bs=1585%2C1200&mtos=1081,1081,1081,1081,1081&tos=1081,0,0,0,0&p=393,428.5,483,1156.5&mcvt=1081&rs=3&ht=0&tfs=1441&tls=2522&mc=1&lte=1&bas=0&bac=0&met=0&avms=nio&niot_obs=22&niot_cbk=219&md=2&rst=1568376063378&rpt=1461&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C3841&ss=1600%2C1200&pt=26&bin=1&deb=1-7-7-18-14-27-157-12-0-0-0&tvt=2509&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20190911

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 10C4 42 B
110 B 15ms
15ms Image
image/gif 2a00:1450:4001:825::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstKR-fk1Q77Kb4MpmUsThBALJOh34HT9Uqkn-IGC88qQIYhAfR6rKdxvqwV0fSQCg90ce1pogPV0Jj4s5OmTj1DWrFvGIjz_OZEXDcLqA8&sig=Cg0ArKJSzNpn2u4duYdxEAE&adk=2603228583&tt=2498&bs=1585%2C1200&mtos=1081,1081,1081,1081,1081&tos=1081,0,0,0,0&p=513,1042.5,763,1342.5&mcvt=1081&rs=3&ht=0&tfs=1441&tls=2522&mc=1&lte=1&bas=0&bac=0&met=0&avms=nio&niot_obs=22&niot_cbk=219&md=2&rst=1568376063391&rpt=1404&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C3841&ss=1600%2C1200&pt=26&bin=1&deb=1-7-7-18-14-27-157-12-0-0-0&tvt=2509&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20190909

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8 Show response
www.zdnet.com/video/manifest/ 3 KB
1 KB 281ms
280ms XHR
application/x-mpegurl 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/video/manifest/this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true

Requested by

Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7807bd530ffb903cb81e262166b6720a6f32b87498e5f502d587f18b555532ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 406
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Sep 2019 12:01:06 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:06 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 3dd6309c-24db-473e-b6db-e1c3288e5650
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 13 Sep 2019 13:31:06 GMT

GET
H/1.1 200
OK 10d31225525ff5790a490d4d-adobeorg.xml Show response
cbsinteractive.hb.omtrdc.net/settings/ 228 B
624 B 299ms
95ms XHR
application/xml 52.44.156.47
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1568376066254
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.156.47 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-156-47.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 11:57:52 GMT
Last-Modified: Fri, 06 Sep 2019 08:05:26 GMT
Server: nginx
ETag: "5d721346-e4"
Access-Control-Allow-Methods: OPTIONS,GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Location
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Content-Length: 228

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
7 KB 126ms
126ms XHR
text/plain 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=482274738421342&correlator=2721633825244631&output=ldjh&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&json_a=1&eid=21064570%2C21062414%2C21062888%2C21064170%2C21064267&vrg=2019090501&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20190913&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11%2C641x321&fluid=height%2C0&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cwindows%26mfr%3Deset-llc%26tag%3Dmalware%252Ctarget%26prodtype%3Dantivirus%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dwindows-malware-strain-records-users-on-adult-sites%26env%3Dprod%26firstpg%3D1%26vguid%3Daab7e17d-2bcd-45fa-9c2f-40266416e46d%26session%3Df%26subses%3D6&cookie_enabled=1&bc=31&abxe=1&lmt=1568376060&dt=1568376066274&dlt=1568376060900&idt=496&frm=20&biw=1585&bih=1200&oid=3&adxs=208%2C-12245933&adys=1753%2C-12245933&adks=995749670%2C1375492919&ucis=h%7Ci&ifi=10&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&dssz=98&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x11%7C770x2478&msz=770x11%7C641x361&psts=Ci4IvL321hFCA9GcH3gB6AH0ybGAgwSCAgyZ0q4H0eCgC5nQoQvRAscC8t2SV4-q%2CCiYIqcqxc-gBuYGm5ZgCggIMmdKuB9HgoAuZ0KEL0QLcibHV-Gk6qw%2CCiYIqcqxc-gB0fvn5ZgCggIMmdKuB9HgoAuZ0KEL0QJsoMrEFfvZpg%2CCiYI6fjgeOgB0fvn5ZgCggIMmdKuB9HgoAuZ0KEL0QIZjPffGfY-xg%2CCiYI6fjgeOgBzvuMjYMEggIMmdKuB9HgoAuZ0KEL0QJ4pP-BmHGqNw%2CCiYIqcqxc-gByrD8jIMEggIMmdKuB9HgoAuZ0KEL0QK09YKVt0w_ZQ%2CCicIhNOZ_RHoAbnfqIGDBIICDJnSrgfR4KALmdChC9EC1e0oyoachec&ga_vid=438170474.1568376063&ga_sid=1568376063&ga_hid=811086615&fws=4%2C132&ohw=1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019090501.js?21064570

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

4cd49ad64b6dfe822613397924717ad6cfc15f73fc5b1ebcb4ad80fead211545

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 7343
x-xss-protection: 0
google-lineitem-id: 4745189935,4745327422
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239344472,138239368367
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.zdnet.com/m3d0s1/xhr/right-rail/ 11 KB
3 KB 307ms
307ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/m3d0s1/xhr/right-rail/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f8617fa330d363023687ae4389f257a923d8650d0c19ce02081c454be4dc2c37

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 1725
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:06 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 0d9d7eb4-4d21-4450-958c-36c08dc32de8
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Fri, 13 Sep 2019 12:01:06 GMT

GET
H/1.1 200
OK s07526238633571
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/ 43 B
520 B 99ms
99ms Image
image/gif 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s07526238633571?AQB=1&ndh=1&pf=1&t=13%2F8%2F2019%2014%3A1%3A6%205%20-120&mid=55741767664217319690087456407840144009&aid=2EBDC280052CD07F-600029AFE00AFDB3&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c.&siteEdition=eu&siteSection=editorial&siteType=responsive%20web&articleId=24b81636-bab9-41c8-9b82-7f5bca5d1193&articleType=content_article&articleTitle=windows%20malware%20strain%20records%20users%20on%20adult%20sites&pageType=article&pageViewGuid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=D%3Dg&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity%7Cwindows&videoAuthor=zdnet%20editors&Network=zdnet&tl=Monokle%3A%20The%20007%20of%20spying%20malware&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&a.&contentType=vod&media.&name=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&friendlyName=Monokle%3A%20The%20007%20of%20spying%20malware&length=56&playerName=UVPJS_0.42.297&view=true&vsid=1568376066256848101456&.media&.a&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Last-Modified: Sat, 14 Sep 2019 12:01:06 GMT
Server: Omniture DC
xserver: www135
ETag: "3368061955736371200-6650595851880523577"
Vary: *
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 12 Sep 2019 12:01:06 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BBC2 0
56 B 163ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~k0i2m5fu&chm=1&ctx=2&qqid=CMLr85HgzeQCFcg24Aodk3IIYQ&met.6=6.1_Cg0YugYgZCoGCAgSAhAB
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:06 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/cbsinteractive-zdnet/ 84 KB
19 KB 30ms
6ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8bbab7355d5aa551c9f5152fac15aa857d1e352242440ce6911a4e8eef321500

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: U8wN2az2a8oXD_Oos5M5xV5YnT4Twwju
content-encoding: gzip
etag: "df80d9c3040bf21067053575df545fac"
age: 75
x-cache: HIT
status: 200
content-length: 18765
x-amz-id-2: TFTvVlYzYxDxuEzrPlj4vkfPHhvwYH2fWAZkz+FBxVBDewfnnBrfYayOAel+vdN4tWN7vfMuZjc=
x-served-by: cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 14:50:51 GMT
server: AmazonS3
x-timer: S1568376066.403740,VS0,VE1
date: Fri, 13 Sep 2019 12:01:06 GMT
vary: Accept-Encoding
x-amz-request-id: 8B32C10FD489ACD0
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 28
x-cache-hits: 1

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 7ms
7ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Sat, 14 Sep 2019 12:01:06 GMT

GET
H2 200 load.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 13 KB
5 KB 24ms
8ms Script
binary/octet-stream 151.101.13.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding: gzip
etag: "fc0de48a0976cde02ddee0bd49a81832"
age: 303
x-cache: HIT, HIT
status: 200
content-length: 4742
x-amz-id-2: 3m4ozmImbbsGQiBonJe2XNc09km3KzQwD5GLrrMfV0+ONLQL25HRbUvJOO3vSD+p9niYdM2EFtY=
x-served-by: cache-lax8626-LAX, cache-fra19152-FRA
last-modified: Thu, 20 Oct 2016 17:48:07 GMT
server: AmazonS3
x-timer: S1568376066.440092,VS0,VE1
date: Fri, 13 Sep 2019 12:01:06 GMT
vary: Accept-Encoding,,
x-amz-request-id: 45D2E8320DAF3E82
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=300
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 1, 1

GET
H2 200 impl.20190911-24-RELEASE.js Show response
cdn.taboola.com/libtrc/ 393 KB
111 KB 7ms
7ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20190911-24-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 079c6baf748d3b543bd11d58558f93c92619dfc023b34b66a1c3648a4f01feee

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: Blzyav7I7Fqr90naydKIw6WeS8AJ8pk2
content-encoding: gzip
etag: "46435c29fa55e5bb182a8089f8899af1"
age: 86
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 113770
x-amz-id-2: TpwWJhvTI2hPC4MqvfN6kcPHT+HJbADzqUA74zo+2QRKfb2VA14qMvLQnsDazZSdOLTYf5jCbYo=
x-served-by: cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 13:41:59 GMT
server: AmazonS3
x-timer: S1568376066.424464,VS0,VE0
date: Fri, 13 Sep 2019 12:01:06 GMT
vary: Accept-Encoding
x-amz-request-id: F64D595A7D85A57A
via: 1.1 varnish
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 75
x-cache-hits: 624

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame AE53 0
58 B 23ms
21ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuB147NCnonnw1lZo1abEWt4kdkqKvOqqtnEgEs1KSNPKrGRQWsHMghr3zAOP_o-CvitjpfzF-ZrKCHSUDm8Iexk-i8HMk2TqwXylNy5hRwHAAJW-eDfxDeIGqxQU2fMF7AuYzOJPJ7bybB2Eqt4o7j4SfGuFE-WHGGzqEPF02p-B3nLctUxklp0jPjGVI5LaZ0o_viEZfuj5PbY1L1O6bL26JbszImZgyWmvixUitSjsq96_p_cURfvayV9JXi6QIT7ZAYVzZH&sig=Cg0ArKJSzJKP0U5V4dgXEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame AE53 75 KB
28 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:06 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame AE53 307 KB
103 KB 11ms
10ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame E265 0
58 B 17ms
17ms Fetch
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv1ooUk5rcNR2Oyz3S0RXSupP5OYBebr-jvS2VWepVcLcQTkor8O0yVrJrc6gSWMPr795Dq3mD--UziV6ZdfUQKpu2Oxr212Tzdkam7m5JKIxDY1kCShz8v3V-we4taNHqtYlFncWS2Qqo_HpufrRge6EmNOiwnMBWRSd-bB3RSlFGfW1826mFVanp_Ox_NDKKgYrdVMSnUehw-blNEkquE9NDI4m5w0AYko4p99lHaxweCYGnKssSv6n1NLQK1iYOL7-yJJPbh&sig=Cg0ArKJSzJigf6Tow7jPEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 Sep 2019 12:01:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame E265 75 KB
28 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1568027754411643"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28564
x-xss-protection: 0
expires: Fri, 13 Sep 2019 12:01:06 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame E265 307 KB
103 KB 20ms
20ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019090501.js?21064570
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Aug 2019 14:24:12 GMT
Server: AmazonS3
x-amz-request-id: E0666504BD3BC5C0
ETag: "25556c1ffa69be6c7e1c3ae5e4fe3fb0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=60573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104539
x-amz-id-2: j3ST4nTUJtVQdALFxWJWN0r+yyWNfia0N3yoOrhXmvF4Gyo7xeTirTrgbpU0lvcAFtKUw3P1Azs=

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https...
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=http...

0
248 B

7ms
6ms

Image
text/plain

184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1568376066469&ns_c=UTF-8&cv=3.1e&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c9=
Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pmk-201618008.1.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 323 KB
89 KB 6ms
6ms Script
text/javascript 151.101.13.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding: gzip
etag: "da73fb2066df9f51d08b6688cfb35441"
age: 28080481
x-cache: HIT, HIT
status: 200
content-length: 91236
x-amz-id-2: T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by: cache-lax8630-LAX, cache-fra19152-FRA
last-modified: Thu, 20 Oct 2016 17:47:53 GMT
server: AmazonS3
x-timer: S1568376066.475407,VS0,VE0
date: Fri, 13 Sep 2019 12:01:06 GMT
vary: Accept-Encoding,,
x-amz-request-id: 58FF20717A687DE4
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: text/javascript
x-cache-hits: 386, 15

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 96ms
95ms XHR
text/plain 52.44.156.47
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EBDC280052CD07F-600029AFE00AFDB3&s:user:mid=55741767664217319690087456407840144009&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1568376066256848101456&s:event:type=start&l:event:duration=2&l:event:playhead=0&l:event:ts=1568376066266&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Monokle%3A%20The%20007%20of%20spying%20malware&s:asset:video_id=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=56&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteEdition=eu&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=24b81636-bab9-41c8-9b82-7f5bca5d1193&s:meta:articleType=content_article&s:meta:articleTitle=windows%20malware%20strain%20records%20users%20on%20adult%20sites&s:meta:pageType=article&s:meta:pageViewGuid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=D%3Dg&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity%7Cwindows&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=Monokle%3A%20The%20007%20of%20spying%20malware&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.156.47 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-156-47.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 13 Sep 2019 11:57:52 GMT
X-VaRouter-Backend: prod15
Server: nginx
Connection: keep-alive

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 197ms
95ms XHR
text/plain 52.44.156.47
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EBDC280052CD07F-600029AFE00AFDB3&s:user:mid=55741767664217319690087456407840144009&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1568376066256848101456&s:event:type=play&l:event:duration=0&l:event:playhead=0&l:event:ts=1568376066266&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Monokle%3A%20The%20007%20of%20spying%20malware&s:asset:video_id=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=56&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.156.47 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-156-47.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 13 Sep 2019 11:57:52 GMT
X-VaRouter-Backend: prod15
Server: nginx
Connection: keep-alive

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 283ms
94ms XHR
text/plain 52.44.156.47
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2EBDC280052CD07F-600029AFE00AFDB3&s:user:mid=55741767664217319690087456407840144009&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1568376066256848101456&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1568376066355&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Monokle%3A%20The%20007%20of%20spying%20malware&s:asset:video_id=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=56&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.156.47 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-156-47.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 13 Sep 2019 11:58:50 GMT
X-VaRouter-Backend: prod15
Server: nginx
Connection: keep-alive

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800.m3u8 Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800/ 1 KB
477 B 860ms
804ms XHR
application/x-mpegurl 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800.m3u8
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a21cb026de011b49d2443b5d6e3f114a60afc187b7ac7d5153dcf1273ab38807

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
content-encoding: gzip
last-modified: Thu, 01 Aug 2019 14:14:45 GMT
server: AkamaiNetStorage
status: 200
etag: "c7ec4870d49a9d17856def999069bb38:1564668889"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 252

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:825::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 4653
date: Fri, 13 Sep 2019 10:43:33 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17803
expires: Fri, 13 Sep 2019 12:43:33 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 9ms
8ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Sat, 14 Sep 2019 12:01:06 GMT

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame A747 0
0 11ms
11ms Document
text/plain 151.101.13.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Fri, 13 Sep 2019 12:01:06 GMT
via: 1.1 varnish
x-served-by: cache-fra19152-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1568376067.659009,VS0,VE0
content-length: 0

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 28ms
27ms Script
text/javascript 2606:4700::6810:a30d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a30d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27a1b8a51741d0473ab2eab70188657fd20d755ba84e0b3e6a51e6f94d7e3a4b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1523173
cf-ray: 5159f6f11a7e5952-VIE
status: 200
content-length: 27531
x-amz-id-2: eDK221dk774em4I6DMckLF57cozzz5yxbbsqbNOpYqfEO21OTmL1ZPH68Dxg4rRcOhYmJd75OLE=
last-modified: Mon, 29 Jul 2019 20:54:38 GMT
server: cloudflare
etag: "bdefbb6abea5b94d18f16f50ec3ebaae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CFF6D417906FF967
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Fri, 13 Sep 2019 12:31:06 GMT

GET
H/1.1 200
OK 0.15440719965732974
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 43 B
520 B 98ms
98ms Image
image/gif 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.15440719965732974?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=windows+malware+strain+records+users+on+adult+sites&v22=content_article&v23=&v24=aab7e17d-2bcd-45fa-9c2f-40266416e46d&v30=24b81636-bab9-41c8-9b82-7f5bca5d1193&v60=33167546,33165277,33167553&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201909130-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Last-Modified: Sat, 14 Sep 2019 12:01:06 GMT
Server: Omniture DC
xserver: www135
ETag: "3368061955736371200-5662618683625925883"
Vary: *
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 12 Sep 2019 12:01:06 GMT

GET
H/1.1 200
OK e.gif
dw.cbsi.com/levt/ria/ 43 B
369 B 151ms
150ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&assettitle=windows%20malware%20strain%20records%20users%20on%20adult%20sites&assettype=content_article&pubdate=2019-08-08%2019%3A22%3A11&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=24b81636-bab9-41c8-9b82-7f5bca5d1193&v16=aab7e17d-2bcd-45fa-9c2f-40266416e46d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1568376066737&tcset=utf8&im=dsjs&title=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=683
Content-Length: 43
Expires: Fri, 23 Jan 1970 12:12:12 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:825::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=811086615&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites&ul=en-us&de=UTF-8&dt=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=1912359443&gjid=651654294&cid=438170474.1568376063&tid=UA-33613588-22&_gid=294649911.1568376067&_r=1&cd2=other&z=933386071

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame A347 0
0 6ms
6ms Document
text/plain 151.101.13.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Fri, 13 Sep 2019 12:01:06 GMT
via: 1.1 varnish
x-served-by: cache-fra19152-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1568376067.909408,VS0,VE0
content-length: 0

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 42 B
721 B 35ms
35ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cb205eb84da54ef1aca36e56124b2ae4cb630cd8f8612d1f4e159260c301327c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ Frame 2216 793 B
1 KB 30ms
29ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&pv=1568376063938_y00pvx0dy&bl=en-us&cb=973841&return=&ht=&d=&dc=&si=1568376063938_y00pvx0dy&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?1382019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a89e086bcbe75d1aaa9b54cc3b572422fd9560d183eb6a456678639812ce5cf2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:06 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 486
Expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ Frame 2216 20 B
698 B 168ms
168ms Script
application/javascript 34.233.109.111
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=1382019
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?1382019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.109.111 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-233-109-111.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:07 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 138
Expires: Sat, 14 Sep 2019 12:01:07 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 2216
Redirect Chain

https://tags.bluekai.com/site/20486?limit=0&id=5978151497031144163&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151497031144163%26eid=50056
https://ml314.com/csync.ashx?fp=9%2BPfJx99999aNU%2B5&person_id=5978151497031144163&eid=50056

43 B
312 B

28ms
28ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=9%2BPfJx99999aNU%2B5&person_id=5978151497031144163&eid=50056
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:07 GMT

Redirect headers

Location: https://ml314.com/csync.ashx?fp=9%2BPfJx99999aNU%2B5&person_id=5978151497031144163&eid=50056
Date: Fri, 13 Sep 2019 12:01:07 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: 7d63
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 2216
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151497031144163
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ5NzAzMTE0NDE2MxAAGg0Ig4ru6wUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=&person_id=5978151497031144163&eid=50082

43 B
312 B

28ms
28ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=&person_id=5978151497031144163&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:07 GMT

Redirect headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=&person_id=5978151497031144163&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 2216
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031144163%26eid=50220
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151497031144163%26eid=50220&mm_bnc&mm_bct&UUID=649d5d7b-7814-4b00-bfea-338405afca2f
https://ml314.com/csync.ashx?fp=649d5d7b-7814-4b00-bfea-338405afca2f&person_id=5978151497031144163&eid=50220

43 B
312 B

28ms
28ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=649d5d7b-7814-4b00-bfea-338405afca2f&person_id=5978151497031144163&eid=50220
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:07 GMT

Redirect headers

Date: Fri, 13 Sep 2019 12:01:07 GMT
Server: MT3 1684 2519bb0 master zrh-pixel-x15
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ml314.com/csync.ashx?fp=649d5d7b-7814-4b00-bfea-338405afca2f&person_id=5978151497031144163&eid=50220
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Fri, 13 Sep 2019 12:01:06 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 2216
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031144163
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151497031144163
https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031144163

43 B
312 B

29ms
29ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031144163
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 14 Sep 2019 08:01:07 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:07 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://ml314.com/csync.ashx?fp=b4ebb8938b22224451b63e65ce95eb4f&eid=50146&person_id=5978151497031144163
Cache-Control: no-cache
X-Server: 10.45.13.130
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame 2216
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2taG-k9ngG2rIB5Ctcy8CC8KhfhbBis8jGcnTRkYGGHY&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
https://ml314.com/csync.ashx?fp=2taG-k9ngG2rIB5Ctcy8CC8KhfhbBis8jGcnTRkYGGHY&person_id=5978151497031144163&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

70 B
171 B

16ms
15ms

Image
image/gif

18.197.149.199
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.197.149.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 13 Sep 2019 12:01:07 GMT
Content-Length: 70
Content-Type: image/gif

Redirect headers

Date: Fri, 13 Sep 2019 12:01:06 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control: private
Connection: keep-alive
Content-Length: 168
Expires: Sat, 14 Sep 2019 08:01:07 GMT

GET
H2 200 json Show response
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 12 KB
5 KB 171ms
169ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=14%3A01%3A07.436&lti=deflated&data=%7B%22id%22%3A778%2C%22ii%22%3A%22%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1568376067434%2C%22cv%22%3A%2220190911-24-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A3860%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A3300.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190911-24-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: fd1c9636b43e0e45401b75ec2dd7a918a999ff6fdcbcf8758a15b18f6baeab1a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
content-encoding: gzip
server: nginx
x-timer: S1568376067.442692,VS0,VE163
status: 200
x-served-by: cache-hhn4071-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800_0.ts Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800/ 536 KB
537 KB 509ms
509ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_800_0.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1992ff92619df9c3971dd2fbba77b6974cc0aa67a7aef63d73ad414a379c4999

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
last-modified: Thu, 01 Aug 2019 14:14:47 GMT
server: AkamaiNetStorage
etag: "cd2e570cc624c99d500b1e6cd10714a4:1564668889"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 548772

GET
BLOB 200
OK 8b735406-1871-4254-bd8b-7247293f9b38
https://www.zdnet.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.zdnet.com/8b735406-1871-4254-bd8b-7247293f9b38
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: BLOB
Security: , ,
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

Sec-Fetch-Mode: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 66527
Content-Type: text/javascript

GET
H2 200 userx.20190911-24-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 22 KB
8 KB 6ms
6ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20190911-24-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3240c7e00ccd21fbdd141f58cb238c68bb59180a35dfb79df8bbe57e0d13b0fc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: FIROvmzvTvRsNpeDMFHG0FOuavH8QxIQ
content-encoding: gzip
etag: "0a4a3b57760282f54d71c05d1bf0b50c"
age: 60
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 7736
x-amz-id-2: XFlx3p8weZn+wiUlEE8ZynhUsKgBYb3vtS/VZ2l7y0XScoPeK1ALn9QstYbSXoG1vTQ9pj+omb0=
x-served-by: cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 13:42:26 GMT
server: AmazonS3
x-timer: S1568376068.635888,VS0,VE0
date: Fri, 13 Sep 2019 12:01:07 GMT
vary: Accept-Encoding
x-amz-request-id: 07DC2D26E0B4B9D3
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 22
x-cache-hits: 194

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
195 B 15ms
15ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=4aed62426e234842b40f5012f78d0e08&sd=v2_fb5b9bb37cf7a485a03d18d147160650_a8673602-3b15-4c2f-9bb7-4564a47718b9-tuct4750a83_1568376067_1568376067_CNawjgYQzro_GOqq_tPSLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/windows-malware-strain-records-users-on-adult-sites&wi=-8487670893299870836&pt=text&vi=1568376067434&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=14%3A01%3A07.645&id=7421&llvl=1&cv=20190911-24-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish
server: nginx
x-timer: S1568376068.649621,VS0,VE8
x-served-by: cache-hhn4071-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
84 B 14ms
14ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=4aed62426e234842b40f5012f78d0e08&sd=v2_fb5b9bb37cf7a485a03d18d147160650_a8673602-3b15-4c2f-9bb7-4564a47718b9-tuct4750a83_1568376067_1568376067_CNawjgYQzro_GOqq_tPSLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/windows-malware-strain-records-users-on-adult-sites&wi=-8487670893299870836&pt=text&vi=1568376067434&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=14%3A01%3A07.646&id=1333&llvl=1&cv=20190911-24-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish
server: nginx
x-timer: S1568376068.649634,VS0,VE8
x-served-by: cache-hhn4071-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
55 B 14ms
14ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=4aed62426e234842b40f5012f78d0e08&sd=v2_fb5b9bb37cf7a485a03d18d147160650_a8673602-3b15-4c2f-9bb7-4564a47718b9-tuct4750a83_1568376067_1568376067_CNawjgYQzro_GOqq_tPSLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/windows-malware-strain-records-users-on-adult-sites&wi=-8487670893299870836&pt=text&vi=1568376067434&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=14%3A01%3A07.646&id=241&llvl=1&cv=20190911-24-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish
server: nginx
x-timer: S1568376068.649699,VS0,VE8
x-served-by: cache-hhn4071-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

POST
H2 204 available Show response
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
263 B 20ms
20ms XHR
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190911-24-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish
server: nginx
x-timer: S1568376068.661686,VS0,VE9
x-served-by: cache-hhn4071-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 200 f28949636d88e64cd3d8349b6b45be1c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 5 KB
6 KB 16ms
11ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f28949636d88e64cd3d8349b6b45be1c.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 1dbc90839e483d8473fe18c16e84f8e914ba4aabb9593731dc8627bdf71c3206

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1679778
edge-cache-tag: 410368660602727655533865371510165981642,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 02 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f28949636d88e64cd3d8349b6b45be1c.jpg
content-length: 5518
x-served-by: cache-hhn4028-HHN, cache-hhn4071-HHN
last-modified: Fri, 02 Aug 2019 15:25:07 GMT
server: cloudinary
x-timer: S1568376068.669411,VS0,VE0
etag: "166588960ba15f08ec7a34725bd2a8a2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 621d596dde79cd3d78c9063febcac90a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 7 KB
8 KB 15ms
11ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/621d596dde79cd3d78c9063febcac90a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 66001a51b61fb8dfa893331f43f0fe1606171f57068ee9e31cc0573cafd20c55

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 169021
edge-cache-tag: 630835939927076145285311571338696773782,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/621d596dde79cd3d78c9063febcac90a.jpg
content-length: 7585
x-served-by: cache-hhn4034-HHN, cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 12:53:10 GMT
server: cloudinary
x-timer: S1568376068.669403,VS0,VE0
etag: "2f3dce7a7fcc7992bc9bf4bbaae13b71"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 KW34_humanvalley_ingame_5f58830c04398fed2eb7cfdcb24b5406.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/093574ca-85f4-49e7-80e2-8679fc1fe545/ 19 KB
19 KB 10ms
7ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/093574ca-85f4-49e7-80e2-8679fc1fe545/KW34_humanvalley_ingame_5f58830c04398fed2eb7cfdcb24b5406.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 9b3d81d93e06d3177fa540cfb18b68c9a0daf92f6f364b4695ac2f93a5007ea4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1243507
edge-cache-tag: 300854685413435272747645539808006337928,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/093574ca-85f4-49e7-80e2-8679fc1fe545/KW34_humanvalley_ingame_5f58830c04398fed2eb7cfdcb24b5406.jpg
content-length: 19202
x-request-id: a8f8ba011d98e418
x-served-by: cache-hhn4047-HHN, cache-hhn4071-HHN
last-modified: Mon, 19 Aug 2019 18:21:39 GMT
server: cloudinary
x-timer: S1568376068.669077,VS0,VE0
etag: "132f3707d192f38d3287b4ffcdfd2fba"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 db51e5f38c8ed8c1fb42a470af4c0051.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 14 KB
14 KB 11ms
8ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/db51e5f38c8ed8c1fb42a470af4c0051.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 349ab8a418f60116720d4b941e614ec9dba6ce2f303f66f83acc74c015a90c7e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1416525
edge-cache-tag: 505257041879976578064921416972977542093,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 02 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/db51e5f38c8ed8c1fb42a470af4c0051.jpg
content-length: 14166
x-served-by: cache-hhn4051-HHN, cache-hhn4071-HHN
last-modified: Fri, 02 Aug 2019 12:32:22 GMT
server: cloudinary
x-timer: S1568376068.669378,VS0,VE0
etag: "2b199f97be2a84ac79aa734ad988d150"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 8

GET
H2 200 aae5488e06777b8ed47802ad2b2778c9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 22 KB
22 KB 11ms
9ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/aae5488e06777b8ed47802ad2b2778c9.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: af2ebee9a7263144c2fe2b80217edd29044f40f190297705492ee9e6f0278d38

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 168784
edge-cache-tag: 491044886225698205866531742430401571861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/aae5488e06777b8ed47802ad2b2778c9.jpg
content-length: 22029
x-served-by: cache-hhn4024-HHN, cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 12:47:07 GMT
server: cloudinary
x-timer: S1568376068.669389,VS0,VE0
etag: "de25608d558341b706da8fc570eb3fd8"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 918778c721cdd8bf5bd4dad2dc676520.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 6 KB
6 KB 12ms
10ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/918778c721cdd8bf5bd4dad2dc676520.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 9305c31e4cef1ae42aa3f16b6fa285d0272eaa1cbb19bbaf98067ba98d89d9d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1817293
edge-cache-tag: 429987792925461636652968703837836617914,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/918778c721cdd8bf5bd4dad2dc676520.jpg
content-length: 6067
x-served-by: cache-hhn4062-HHN, cache-hhn4071-HHN
last-modified: Fri, 23 Aug 2019 11:11:55 GMT
server: cloudinary
x-timer: S1568376068.669429,VS0,VE0
etag: "4addf8b711cb9558ecae55d09d585fad"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 45eb2c80c4134a18d468e8556c804f61.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 12 KB
13 KB 14ms
5ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/45eb2c80c4134a18d468e8556c804f61.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 6548c08846779f8d18623cade2d7e9d58bbceb302694fd28c3a2da6b2ee91924

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 268475
edge-cache-tag: 552850195888318709537279405281158056853,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 11 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/45eb2c80c4134a18d468e8556c804f61.jpg
content-length: 12466
x-served-by: cache-hhn4043-HHN, cache-hhn4071-HHN
last-modified: Tue, 10 Sep 2019 09:16:51 GMT
server: cloudinary
x-timer: S1568376068.686307,VS0,VE0
etag: "f1758cce4ab9c009434b32c82a464cf2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 4330563f68895448661e55acd8bf5386.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 25 KB
25 KB 11ms
6ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4330563f68895448661e55acd8bf5386.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 87ca3135a609706b24d96311da7ca03853cd89ab6478d9128ac9193bb65eb521

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 2194883
edge-cache-tag: 538481937037703942314165137263170740308,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 19 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4330563f68895448661e55acd8bf5386.jpg
content-length: 25312
x-served-by: cache-hhn4048-HHN, cache-hhn4071-HHN
last-modified: Mon, 19 Aug 2019 01:02:43 GMT
server: cloudinary
x-timer: S1568376068.687200,VS0,VE0
etag: "e6c0352dba8f13fec03c0a669010ce90"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 254 B
717 B 6ms
6ms Image
image/png 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20190911-24-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via: 1.1 varnish
etag: "dfa7b52c86e56bd67fa4002f6ed19854"
age: 16384
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 254
x-amz-id-2: grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by: cache-hhn4071-HHN
last-modified: Wed, 24 Jun 2015 07:14:11 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer: S1568376068.694428,VS0,VE0
date: Fri, 13 Sep 2019 12:01:07 GMT
x-amz-request-id: 29D722C296265892
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: image/png
abp: 22
x-cache-hits: 34390

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 61 B
506 B 36ms
36ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 51d64391f9bce4d81cf455193a136387402901b93e01f9247b8167e051699a0e

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:07 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 61
Expires: Thu, 01 Jan 1970 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/093574ca-85f4-49e7-80e2-8679fc1fe545/KW34_humanvalley_ingame_5f58830c04398fed2eb7cfdcb24b5406.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 9b3d81d93e06d3177fa540cfb18b68c9a0daf92f6f364b4695ac2f93a5007ea4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1243507
edge-cache-tag: 300854685413435272747645539808006337928,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/093574ca-85f4-49e7-80e2-8679fc1fe545/KW34_humanvalley_ingame_5f58830c04398fed2eb7cfdcb24b5406.jpg
content-length: 19202
x-request-id: a8f8ba011d98e418
x-served-by: cache-hhn4047-HHN, cache-hhn4071-HHN
last-modified: Mon, 19 Aug 2019 18:21:39 GMT
server: cloudinary
x-timer: S1568376068.841454,VS0,VE0
etag: "132f3707d192f38d3287b4ffcdfd2fba"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/db51e5f38c8ed8c1fb42a470af4c0051.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 349ab8a418f60116720d4b941e614ec9dba6ce2f303f66f83acc74c015a90c7e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1416526
edge-cache-tag: 505257041879976578064921416972977542093,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 02 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/db51e5f38c8ed8c1fb42a470af4c0051.jpg
content-length: 14166
x-served-by: cache-hhn4051-HHN, cache-hhn4071-HHN
last-modified: Fri, 02 Aug 2019 12:32:22 GMT
server: cloudinary
x-timer: S1568376068.849060,VS0,VE0
etag: "2b199f97be2a84ac79aa734ad988d150"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 9

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/aae5488e06777b8ed47802ad2b2778c9.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: af2ebee9a7263144c2fe2b80217edd29044f40f190297705492ee9e6f0278d38

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 168785
edge-cache-tag: 491044886225698205866531742430401571861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/aae5488e06777b8ed47802ad2b2778c9.jpg
content-length: 22029
x-served-by: cache-hhn4024-HHN, cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 12:47:07 GMT
server: cloudinary
x-timer: S1568376068.849080,VS0,VE0
etag: "de25608d558341b706da8fc570eb3fd8"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/918778c721cdd8bf5bd4dad2dc676520.jpg
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 9305c31e4cef1ae42aa3f16b6fa285d0272eaa1cbb19bbaf98067ba98d89d9d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1817294
edge-cache-tag: 429987792925461636652968703837836617914,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/918778c721cdd8bf5bd4dad2dc676520.jpg
content-length: 6067
x-served-by: cache-hhn4062-HHN, cache-hhn4071-HHN
last-modified: Fri, 23 Aug 2019 11:11:55 GMT
server: cloudinary
x-timer: S1568376068.849886,VS0,VE0
etag: "4addf8b711cb9558ecae55d09d585fad"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f28949636d88e64cd3d8349b6b45be1c.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 1dbc90839e483d8473fe18c16e84f8e914ba4aabb9593731dc8627bdf71c3206

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 1679778
edge-cache-tag: 410368660602727655533865371510165981642,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 02 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f28949636d88e64cd3d8349b6b45be1c.jpg
content-length: 5518
x-served-by: cache-hhn4028-HHN, cache-hhn4071-HHN
last-modified: Fri, 02 Aug 2019 15:25:07 GMT
server: cloudinary
x-timer: S1568376068.853082,VS0,VE0
etag: "166588960ba15f08ec7a34725bd2a8a2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/621d596dde79cd3d78c9063febcac90a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 66001a51b61fb8dfa893331f43f0fe1606171f57068ee9e31cc0573cafd20c55

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 169021
edge-cache-tag: 630835939927076145285311571338696773782,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/621d596dde79cd3d78c9063febcac90a.jpg
content-length: 7585
x-served-by: cache-hhn4034-HHN, cache-hhn4071-HHN
last-modified: Wed, 11 Sep 2019 12:53:10 GMT
server: cloudinary
x-timer: S1568376068.853451,VS0,VE0
etag: "2f3dce7a7fcc7992bc9bf4bbaae13b71"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/45eb2c80c4134a18d468e8556c804f61.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 6548c08846779f8d18623cade2d7e9d58bbceb302694fd28c3a2da6b2ee91924

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 268475
edge-cache-tag: 552850195888318709537279405281158056853,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 11 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/45eb2c80c4134a18d468e8556c804f61.jpg
content-length: 12466
x-served-by: cache-hhn4043-HHN, cache-hhn4071-HHN
last-modified: Tue, 10 Sep 2019 09:16:51 GMT
server: cloudinary
x-timer: S1568376068.853474,VS0,VE0
etag: "f1758cce4ab9c009434b32c82a464cf2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4330563f68895448661e55acd8bf5386.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 87ca3135a609706b24d96311da7ca03853cd89ab6478d9128ac9193bb65eb521

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:07 GMT
via: 1.1 varnish, 1.1 varnish
age: 2194883
edge-cache-tag: 538481937037703942314165137263170740308,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 19 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4330563f68895448661e55acd8bf5386.jpg
content-length: 25312
x-served-by: cache-hhn4048-HHN, cache-hhn4071-HHN
last-modified: Mon, 19 Aug 2019 01:02:43 GMT
server: cloudinary
x-timer: S1568376068.856711,VS0,VE0
etag: "e6c0352dba8f13fec03c0a669010ce90"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

POST
H2 204 csi
csi.gstatic.com/ Frame BBC2 0
56 B 163ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~k0i2m5v5&chm=1&ctx=2&qqid=CMLr85HgzeQCFcg24Aodk3IIYQ&met.6=6.1_Cg0Y-xEgfSoGCAgSAhAB
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:07 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800.m3u8 Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 1 KB
475 B 873ms
873ms XHR
application/x-mpegurl 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800.m3u8
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 24d714615a71063f1a34d5ae5a258ace6c2a5030df4f50c08d29c80c83fc6044

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:08 GMT
content-encoding: gzip
last-modified: Thu, 01 Aug 2019 14:16:06 GMT
server: AkamaiNetStorage
status: 200
etag: "06bf049f16f87312d8627718fd29249b:1564668966"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 249

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 7ms
6ms Image
image/gif 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1568376064068&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=56000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1568376068082&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=4013&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C0_42_297&c4=3000074&c6=Monokle%3A%20The%20007%20of%20spying%20malware&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c8=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:08 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 88ms
88ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthis-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8&i=Monokle%3A%20The%20007%20of%20spying%20malware&g0=security&g1=catalin%20cimpanu&u=C4Y0Sg289yABs4H9h&t=DulilUBIZulmy2zHJBFfzwUC2hoaW&x=0&y=0&V=116&VS=VS&n=1&b=2843&_vd=56000&_vi=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&_vh=zdnet.com&_pu=mZZ5IyvxI4T60Xy&_pt=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.001764&_vpt=0.008082&_vaup=man&_vplt=0.42.297&_vce=1&c=0.07&W=0&R=1&I=0&E=1&j=20&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_1.ts Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 1 MB
1 MB 560ms
559ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_1.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ad7008f38b04443b67fa33fe00132b2924351f01412c2b89b0dedf900f4a4a3e

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:09 GMT
last-modified: Thu, 01 Aug 2019 14:16:08 GMT
server: AkamaiNetStorage
etag: "698acbf7958d88bf5bd91371cc71a304:1564668969"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1346080

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 89ms
88ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&u=mZZ5IyvxI4T60Xy&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.12&x=0&m=0&y=4388&o=1585&w=1200&j=30&R=1&W=0&I=0&E=7&e=4&r=&b=2279&t=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&V=116&tz=-120&_acct=anon&_vi=Monokle%3A%20The%20007%20of%20spying%20malware&_vp=/video/manifest/this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=56000&sn=3&sv=ChK7C6G2T-TVWXwYCNxQ6nqcexf&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:09 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ 44 B
424 B 33ms
32ms Image
image/gif 54.194.74.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=us-700144&ch=us-700144_c01_P&asn=defChnAsset&sessionId=l9wxDKfkOlt3Z8D28Ssr0PDEmIMan1568376065&tl=Monokle%3A%20The%20007%20of%20spying%20malware&prv=1&c6=vc,c01&ca=us-700144_c01_9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&cg=ZDNet%20Video&c13=asid,PF7B87067-BF4D-F80F-E040-070AAD316CE6&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,UVPJS|0_42_297&plugv=&playerv=&sup=0&segment2=&segment1=&forward=1&ad=0&cr=4_00_99_V1_00000&c9=devid,&enc=true&c1=nuid,999&at=view&rt=video&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,15683760654868905&c30=bldv,6.0.0.428&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&sd=56&devtypid=&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&c3=st,c&c64=starttm,1568376067&adid=9109e25e-b70b-4eaf-b4ba-f34e4e8b2db1&c58=isLive,false&c59=sesid,ZOWddsZf3c4pUGJSHGsQHduZgK1PV1568376069&c61=createtm,1568376068&c63=pipMode,&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c77=adsuprt,1&uoo=&evdata=&c71=ottflg,0&c72=otttyp,none&c44=progen,&davty=0&si=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&c66=mediaurl,&c62=sendTime,1568376068&rnd=342068
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.74.162 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-194-74-162.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:09 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 m
secure-us.imrworldwide.com/cgi-bin/ 44 B
425 B 31ms
30ms Image
image/gif 54.194.74.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15683760654868905&c30=bldv,6.0.0.428&c6=vc,c01&c3=&cg=ZDNet%20Video&tl=dav0-Monokle%3A%20The%20007%20of%20spying%20malware&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,Monokle%3A%20The%20007%20of%20spying%20malware&pr=iag.epi,Monokle%3A%20The%20007%20of%20spying%20malware%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1568376068&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1568376068&rnd=716731
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.74.162 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-194-74-162.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:09 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_2.ts Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 1 MB
1 MB 534ms
534ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_2.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 39c9649f882cca6a7b808247a5fd2bfacd5ddb93507a110087e7e76b3fec14a9

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:10 GMT
last-modified: Thu, 01 Aug 2019 14:16:09 GMT
server: AkamaiNetStorage
etag: "6704bacd9d010035a6344d7b61c93a72:1564668969"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1462264

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_3.ts Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 1 MB
1 MB 834ms
834ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_3.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3356819c45afefb2cbd6052cca23c255215218f2a9e3a3cc25fa4d1a96344770

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:11 GMT
last-modified: Thu, 01 Aug 2019 14:16:10 GMT
server: AkamaiNetStorage
etag: "b6020cb3458f8350cde85eac2a54082a:1564668970"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1289116

POST
H/1.1 200
OK / Show response
inqlnfvog763mmf771rou737u.litix.io/ 43 B
349 B 90ms
90ms XHR
image/gif 107.23.109.48
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://inqlnfvog763mmf771rou737u.litix.io/
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.109.48 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-109-48.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:11 GMT
Access-Control-Allow-Methods: POST, GET
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_4.ts Show response
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 1 MB
1 MB 533ms
533ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_4.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 31b1fed73b94bb120d4bdd79032112a62767a0bf3d27ef173d3ec6a111cb15d1

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
last-modified: Thu, 01 Aug 2019 14:16:11 GMT
server: AkamaiNetStorage
etag: "023fc5401caec19413a59b38238e4566:1564668972"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1259224

GET
H2 200 / Show response
www.zdnet.com/homepage/xhr/ 257 KB
28 KB 161ms
161ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/homepage/xhr/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9d1cc655fdac69a889568e4a4ea348e343613eec5ed347b5a742303325a43390

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 27226
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Sep 2019 12:00:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:12 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 3c54e641-8e86-4e04-b0d6-af7d1002715b
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 13 Sep 2019 13:30:24 GMT

GET
H2 200 ring.gif
zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ 16 KB
9 KB 7ms
6ms Image
image/gif 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ring.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91835
status: 200
vary: Accept-Encoding
content-length: 9039
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:19:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1bb6-3f75"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:35 GMT

GET
H2 200 ZDLogoMicroRed-x2.png
zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ 2 KB
2 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91835
status: 200
vary: Accept-Encoding
content-length: 1513
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:19:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1bb6-6fa"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:35 GMT

GET 2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_5.ts
techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/ 0
0

GET
H2 200 ZDLogoMicroWhite-x2.png
zdnet4.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ 2 KB
2 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1568283574-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet1.cbsistatic.com/fly/1802-fly/css/core/main-a8666d73c7-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91837
status: 200
vary: Accept-Encoding
content-length: 1398
x-xss-protection: 1; mode=block
last-modified: Thu, 12 Sep 2019 10:19:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d7a1bb6-691"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Sep 2019 10:30:26 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BBC2 0
56 B 163ms
163ms Other
image/gif 2607:f8b0:4005:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=4~k0i2m70u&chm=1&ctx=2&qqid=CMLr85HgzeQCFcg24Aodk3IIYQ&met.6=6.1_Cg0Y3jkgQSoGCAISAhAB
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4005:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 13 Sep 2019 12:01:12 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 river-time-ago-f2210a157b-rev.js Show response
zdnet4.cbsistatic.com/fly/js/components/ 753 B
533 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 541726
status: 200
vary: Accept-Encoding
content-length: 426
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc8c9-2f1"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Sep 2019 05:32:24 GMT

GET
H2 200 tr-premium-promo-49ebdaab89-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 461 B
617 B 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 539388
status: 200
vary: Accept-Encoding
content-length: 287
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:06 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6fc8ca-1cd"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Sep 2019 06:11:24 GMT

GET
H2 200 load-more-34f6119ea4-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 5 KB
2 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 560587
status: 200
vary: Accept-Encoding
content-length: 1803
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Sep 2019 14:23:05 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d6fc8c9-12a2"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Sep 2019 00:18:04 GMT

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
2 KB 399ms
399ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8c33802ba26fad8f15c50e671c35fbce600a669b8cfaa2ade913e54cfa96f8b6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 734
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:13 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 87979f9d-bcd5-4a60-b772-68bd394de3bd
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Fri, 13 Sep 2019 12:01:13 GMT

POST
H2 200 / Show response
www.zdnet.com/m3d0s1/xhr/horizontal/ 14 KB
3 KB 383ms
383ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/m3d0s1/xhr/horizontal/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

284df906e117e9481c978dffe400c4969321a064481ea8c5118f41dc933df870

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 1800
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:13 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 3aeb4b17-4581-4006-9f9e-e17932aca18b
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Fri, 13 Sep 2019 12:01:13 GMT

GET
H2 200 / Show response
www.zdnet.com/components/tr-promo-asset/xhr/ 2 KB
2 KB 161ms
161ms XHR
application/json 2.21.36.253
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1802-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.253 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-253.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

25f80bc58b4ca0c9b0a5377755b16e73e62060176bdf262b45ef1af387cc85e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 620
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Sep 2019 10:52:01 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Fri, 13 Sep 2019 12:01:13 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 6d9a67fb-67b6-4a28-9428-bfc56fb071f2
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Fri, 13 Sep 2019 12:22:01 GMT

GET
H2 200 load-more-1.0.js Show response
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 8 KB
3 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1802-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 237236
status: 200
vary: Accept-Encoding
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Tue, 10 Sep 2019 14:06:11 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d77add3-1f51"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Sep 2019 18:07:17 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 88ms
88ms Image
image/gif 107.23.96.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthis-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history.m3u8&i=Monokle%3A%20The%20007%20of%20spying%20malware&g0=security&g1=catalin%20cimpanu&u=C4Y0Sg289yABs4H9h&t=DulilUBIZulmy2zHJBFfzwUC2hoaW&x=0&y=0&V=116&VS=VS&n=1&b=2843&_vd=56000&_vi=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F&_vh=zdnet.com&_pu=mZZ5IyvxI4T60Xy&_pt=BcZOXYC4stOF6cFVPD7hxOXBxeHIV&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.006763&_vpt=4.973408&_vaup=man&_vplt=0.42.297&_vce=6&c=0.15&W=0&R=1&I=0&E=6&j=20&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.96.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-96-251.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 13 Sep 2019 12:01:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1920093
status: 200
vary: Accept-Encoding
content-length: 3552
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Aug 2019 17:44:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d5c3187-f53"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Aug 2019 06:39:29 GMT

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 25ms
25ms Script
text/javascript 2606:4700::6810:a30d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a30d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27a1b8a51741d0473ab2eab70188657fd20d755ba84e0b3e6a51e6f94d7e3a4b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 13 Sep 2019 12:01:13 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1523180
cf-ray: 5159f71a4c685952-VIE
status: 200
content-length: 27531
x-amz-id-2: eDK221dk774em4I6DMckLF57cozzz5yxbbsqbNOpYqfEO21OTmL1ZPH68Dxg4rRcOhYmJd75OLE=
last-modified: Mon, 29 Jul 2019 20:54:38 GMT
server: cloudflare
etag: "bdefbb6abea5b94d18f16f50ec3ebaae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CFF6D417906FF967
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Fri, 13 Sep 2019 12:31:13 GMT

GET
H/1.1 200
OK 0.019655761652968007
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 43 B
520 B 97ms
96ms Image
image/gif 34.237.94.5
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.019655761652968007?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN4f4b3a2&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=windows+malware+strain+records+users+on+adult+sites&v22=content_article&v23=&v24=aab7e17d-2bcd-45fa-9c2f-40266416e46d&v30=24b81636-bab9-41c8-9b82-7f5bca5d1193&v60=33167142,33163941,33167549,33165221&v64=2149&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201909130-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.94.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-237-94-5.compute-1.amazonaws.com
Software: Omniture DC /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:13 GMT
Last-Modified: Sat, 14 Sep 2019 12:01:13 GMT
Server: Omniture DC
xserver: www268
ETag: "3368061970768756736-7209323752591768009"
Vary: *
X-C: ms-6.9.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 12 Sep 2019 12:01:13 GMT

GET
H/1.1 200
OK e.gif
dw.cbsi.com/levt/ria/ 43 B
369 B 151ms
150ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=24b81636-bab9-41c8-9b82-7f5bca5d1193&assettitle=windows%20malware%20strain%20records%20users%20on%20adult%20sites&assettype=content_article&pubdate=2019-08-08%2019%3A22%3A11&viewguid=aab7e17d-2bcd-45fa-9c2f-40266416e46d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=24b81636-bab9-41c8-9b82-7f5bca5d1193&v16=aab7e17d-2bcd-45fa-9c2f-40266416e46d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1568376073320&tcset=utf8&im=dsjs&title=Windows%20malware%20strain%20records%20users%20on%20adult%20sites%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 Sep 2019 12:01:13 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=892
Content-Length: 43
Expires: Fri, 23 Jan 1970 12:12:12 GMT

GET json
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html

Domain: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1

Domain: techrepublicmedia.akamaized.net
URL: https://techrepublicmedia.akamaized.net/media/2019/08/01/1579786819644/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800/2019-08-01-wochit-this-android-malware-can-take-photos-and-videos-and-spy-on-your-app-history_1902477_1800_5.ts

Domain: trc.taboola.com
URL: https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=14%3A01%3A13.459&lti=deflated&data=%7B%22id%22%3A100%2C%22ii%22%3A%22%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1568376067434%2C%22cv%22%3A%2220190911-24-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwindows-malware-strain-records-users-on-adult-sites%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A8793%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A7937.53125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22deflated%22%7D

Verdicts & Comments Add Verdict or Comment

330 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 07:58:48	Name: demdex Value: 06621856773385938274255468056300253772
.lightboxcdn.com/	1970-01-19 12:25:12	Name: __cfduid Value: d1a327ff57ba348ae868ebce9f15afe771568376061
.zdnet.com/	1970-01-19 03:49:40	Name: RT Value: "sl=1&ss=1568376059615&tt=2900&obo=0&bcn=%2F%2F686eb51b.akstat.io%2F&sh=1568376062519%3D1%3A0%3A2900&dm=zdnet.com&si=70c12a37-05c1-49e7-9cc9-460451977f7d&ld=1568376062519"
.zdnet.com/	1970-01-19 12:25:12	Name: utag_main Value: v_id:016d2a7f7def0093ffbf662e5f4800079005207100b08$_sn:1$_ss:0$_st:1568377862497$ses_id:1568376061424%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/	1969-12-31 23:59:59	Name: fly_default_edition Value: eu
www.zdnet.com/	1970-01-19 13:08:24	Name: _cb Value: mZZ5IyvxI4T60Xy
.zdnet.com/	1970-01-19 21:12:14	Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg Value: -894706358%7CMCMID%7C06775154063812565394276730073629308724%7CMCAAMLH-1568980862%7C6%7CMCAAMB-1568980862%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1568383262s%7CNONE%7CvVersion%7C2.3.0
.demdex.net/	1970-01-19 07:58:48	Name: dextp Value: 269-1-1568376062200\|477-1-1568376062301\|771-1-1568376062402\|22052-1-1568376062503
.zdnet.com/	1969-12-31 23:59:59	Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg Value: 1
www.zdnet.com/	1969-12-31 23:59:59	Name: viewGuid Value: aab7e17d-2bcd-45fa-9c2f-40266416e46d
.zdnet.com/	1970-01-19 03:39:37	Name: s_invisit Value: true
.zdnet.com/	1970-01-19 03:39:37	Name: s_lv_zdnet_s Value: First%20Visit
www.zdnet.com/	1970-01-19 03:39:37	Name: _cb_svref Value: null
www.zdnet.com/	1970-01-22 19:15:36	Name: LDCLGFbrowser Value: 3a1cd66c-81bd-4ddf-976d-18e94afb5b55
.zdnet.com/	1970-01-19 04:22:48	Name: s_vnum Value: 1570968061986%26vn%3D1
.zdnet.com/	1970-01-19 03:40:33	Name: first_page_today Value: false
www.zdnet.com/	1970-01-19 13:08:24	Name: _chartbeat2 Value: .1568376061881.1568376061881.1.ChK7C6G2T-TVWXwYCNxQ6nqcexf.1
www.zdnet.com/	1970-01-19 13:08:24	Name: _cb_ls Value: 1
.zdnet.com/	1969-12-31 23:59:59	Name: zdnet_ad Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D
.zdnet.com/	1970-01-19 04:22:48	Name: s_getNewRepeat Value: 1568376061988-New
.zdnet.com/	1970-01-19 03:49:40	Name: fly_device Value: desktop
.zdnet.com/	1970-01-20 05:56:24	Name: s_lv_zdnet Value: 1568376061988
www.zdnet.com/	1970-01-22 19:15:36	Name: _ccmsi Value: 1568376061594_kceob87nd\|1568376061594
www.zdnet.com/	1970-01-22 19:15:36	Name: XCLGFbrowser Value: Sh3Mdl17hP2MTnw4rb8
.zdnet.com/	1969-12-31 23:59:59	Name: fly_preferred_edition Value: eu
.zdnet.com/	1970-01-19 03:49:40	Name: fly_geo Value: {"countryCode": "de"}
www.zdnet.com/	1970-01-22 19:15:36	Name: _ccmaid Value: 5978151497031143237
.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites	1970-01-19 07:58:48	Name: CBS_INTERNAL Value: 0

86 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service pending (GDPR consent not granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service pending (GDPR consent not granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service pending (GDPR consent not granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service pending (GDPR consent not granted): script_gpt
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 522) Message: dom not ready, setting event
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 522) Message: dom not ready, setting event
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 757) Message: ADS: queuing nav-ad-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1227) Message: ADS: queuing intromercial-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1295) Message: ADS: queuing leader-plus-top-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1443) Message: ADS: queuing inpage-video-top-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1453) Message: ADS: queuing sharethrough-top-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1694) Message: ADS: queuing mpu-plus-top-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1798) Message: ADS: queuing dynamic-showcase-top-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 1805) Message: ADS: queuing mpu-middle-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 2083) Message: ADS: queuing mpu-bottom-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 2101) Message: ADS: queuing leader-plus-bottom-5d7b84fbc2c10 for display
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service pending (GDPR consent not granted): script_sharethrough
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 524) Message: dom ready, triggering load
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 524) Message: dom ready, triggering load
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: GDPR consent granted
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent finally granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent finally granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent finally granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent finally granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent finally granted): script_sharethrough
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9) Message: Missing adCookieData!
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_chartbeat_video
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_ad
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177) Message: Service: sitecatalyst
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_video
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_urban_airship
console-api	warning	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: VideoManager.initialize() did not receive a valid error callback function.
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: UVPJS 0.42.297 02/01/19 10:20:35 AM (PST)
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	log	(Line 61) Message: blank creative loaded: 138245072116 (5 x 5, pos=nav)
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: [MUX] _initializePlugin
console-api	warning	URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8) Message: mPulse: Custom Timer 'video_ploaded' is not defined
console-api	log	(Line 61) Message: blank creative loaded: 138239375540 (372 x 142, pos=)
console-api	log	(Line 61) Message: blank creative loaded: 138239479696 (372 x 142, pos=)
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** register GGCMB
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** init GGCMB
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** register GLCFG
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** init GLCFG
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** register PLSTM
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLSTM
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** register PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** register PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** init PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** register PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** register PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** init PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLSTM
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	(Line 61) Message: blank creative loaded: 138239344472 (11 x 11, pos=top)
console-api	log	(Line 61) Message: blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28) Message: [14:01:08 GMT+0200 (Central European Summer Time).029] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	URL: https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c83e.akstat.io
686eb51b.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon-eu2.rubiconproject.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsadsales-a.akamaihd.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn-magiclinks.trackonomics.net
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
l.betrad.com
lightboxapi2.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
zdnet-1.disqus.com
104.108.34.58
104.108.48.32
104.109.78.125
104.17.209.240
107.23.109.48
107.23.96.251
13.35.253.65
151.101.114.133
151.101.114.2
151.101.13.181
152.199.23.241
172.217.16.198
18.130.114.178
18.197.149.199
184.25.159.208
184.30.221.201
184.31.90.90
185.33.223.209
2.16.186.72
2.16.186.88
2.18.233.143
2.18.234.21
2.18.235.40
2.19.38.84
2.21.36.253
2.21.37.45
2001:4998:58:4904::7000
216.58.207.66
216.58.210.2
23.99.128.52
2600:9000:2057:6800:2:42d9:3100:93a1
2600:9000:2057:d600:1d:8c8c:47c0:93a1
2600:9000:20bb:2200:18:1fcd:349:ca21
2606:4700:20::6819:a322
2606:4700::6810:50a5
2606:4700::6810:a30d
2607:f8b0:4005:802::2003
2a00:1450:4001:809::200a
2a00:1450:4001:80b::2006
2a00:1450:4001:818::2002
2a00:1450:4001:81b::2002
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::2003
2a00:1450:4001:81f::2004
2a00:1450:4001:825::2002
2a00:1450:4001:825::200e
2a01:4a0:1338:28::c38a:ff11
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:3::444
2a04:4e42:3::621
34.233.109.111
34.237.94.5
34.247.192.223
34.248.158.173
35.157.160.140
35.190.38.167
35.190.72.21
35.227.208.151
52.44.156.47
54.194.74.162
54.210.129.141
54.76.84.205
54.77.88.162
64.30.230.22
66.117.28.68
66.117.28.86
69.173.144.140
69.173.144.152
99.80.15.126
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05e529a757d25aa9d160d28e57c20041eee3f973870c0f0ad4ac7c21937254b1
0643ff5416a6cde0a3a83371cf5f7f4f7c2ff4436fd3d6b9a5eb89d4f33bc00f
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
079c6baf748d3b543bd11d58558f93c92619dfc023b34b66a1c3648a4f01feee
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
0821a4e3c939f773991479316a8e6dbbe73959d2a1b2830ddd79567d51b94241
0a677bb65787c5d53bf6830ad86e00c717e793f5ee13a0116017cb004fa0fda3
0b02d7a500ed96bb84b65bbcb27ee8524a12424170a0f02aa8a0e4604df3d086
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
0c2f109ae0c67290a3e4c7e0df0404e71697a5176711fb666c34d6d990d209a4
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f5494fdf23362c3399a615baed6c55d8410af6685e2aeb1499758a1c397de98
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11786d0c519ee1ff5ca0ba0d699539e29b05c7273834da0954b3609025ad8303
1186c32d6e1164efd9ca97ef49c4e2bd0eff1c61d650bac38c3bc7d01d2b8c72
12bdb2e244cdb7b686f139afaeb84701747cd38419ac2f5cc44d3805e9034079
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
155935e0a93c8ec455550b190009b63e38f69b99ba20dbdc3da5dfe1271b89b7
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1992ff92619df9c3971dd2fbba77b6974cc0aa67a7aef63d73ad414a379c4999
19a1f60f62fc84dbc96d19186521eb5acc9c13fcc76382bf13ca37c9c2ad2f13
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1dbc90839e483d8473fe18c16e84f8e914ba4aabb9593731dc8627bdf71c3206
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1e136ad5006832ad9ffc64d8f28eae6ddc9d8ec274145284158f99a93d35c9fa
1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df
1f948056b50b22854611638a2a293c1f4eb05e9b72c29b2e3f41eefabd789788
241104f5a0d61f4319f7d7d549bdbc49a68036de7785bdddc3eb12b619d61875
24d714615a71063f1a34d5ae5a258ace6c2a5030df4f50c08d29c80c83fc6044
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
254d3f8a34c7588699b59df97f7e9192813f84c8a1cee5ac492d9df040c46f11
25f80bc58b4ca0c9b0a5377755b16e73e62060176bdf262b45ef1af387cc85e6
277c3b1aa9849ea281525d0d823264cf6f245eebc87636cd03b587214f79f6cb
27a1b8a51741d0473ab2eab70188657fd20d755ba84e0b3e6a51e6f94d7e3a4b
284df906e117e9481c978dffe400c4969321a064481ea8c5118f41dc933df870
29655aa4bb3dca26b3d6a18c3a4aadcf7a6d13718611dc8c12d86f66ebabefe5
2aae3b67c345f508467d56bbb14ffc2e62e24e60a868b4d62a72c9a992954263
2b53e383b81263b9e529c236116454190c04d520031d5f4abaf5e4df40805cd5
2b6a676ced219af0c45a7d7849b816ea45a70b873501f96281df006b378a1088
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2dd79636c16cdb934371ddaa3aa98eb9fb083ccd3d58668fb499944b133fe98d
2eb295ab1538aea6c5abf5d22c90ed13f1a50ea7b4961a0e8fe3b0052ce424d7
2ee2cc34755627fb82cb15d9ce3f00fe9fac8111052f5ec56e35ae71739d11fa
2f0557b0e113d89d7fc0559298d47b4478b75516989c159390a9326c3c575c1d
2f836c619ecf6843eaa3a85b450ad94b77e77c6812eef56edf46d99193ffe184
304475115f769ed86ff1a2d0bc458933a279187eedeb8caa657247f04f6ebd54
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
30d28f4d2f587fc144126c6f1045d16cef7213c965c3c7183bb17b32fd4e3da1
31b1fed73b94bb120d4bdd79032112a62767a0bf3d27ef173d3ec6a111cb15d1
3240c7e00ccd21fbdd141f58cb238c68bb59180a35dfb79df8bbe57e0d13b0fc
3356819c45afefb2cbd6052cca23c255215218f2a9e3a3cc25fa4d1a96344770
349ab8a418f60116720d4b941e614ec9dba6ce2f303f66f83acc74c015a90c7e
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
39c9649f882cca6a7b808247a5fd2bfacd5ddb93507a110087e7e76b3fec14a9
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3a5d8f2eca449cbe28a2dfb6274b459183da7747b2b10d19aeedd30983b6b523
3c8e3b87b7ceb72fd9e41b22593c3e47f4d271dc8e75e87f5ec7dd9708033cb7
3d14abd3048f0e77ff64ace93cbfe3ef48584bd0570bf7303b3bbf5ea0ffab6f
3f2fd858500788978bcb0b96d6eb5fadb0764921a0f699adc576071d996d3c8f
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
4021f17f04d1808610fd53096d9a57e97d86a7d8c94cd86b970640c4f99a70c6
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
4380867f2fdf8f4fd45fe8fe1ebdc4bed353b5e84992ecf0e8da4a766e4238ca
443238fc6591bfd1bc56ce75064045ecd9f8619bf2d2b18d8420c4d9b5baa618
47457cf5d242b3bce0848024f1895820d37e16497ee929cec3672ae001c47f1e
475cb34329f0cc4ae20402c8aea3739fe66574e592a8c9605cd94f220ad88f37
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
4abaff8cce54635705ffb6997ebebaad006c1f9e1a58db2480940ef307b24657
4b4a1db2b64f0618827c21c3c01038cdb1f1618fcd9c727676c323f9d286185b
4b885bae17502c4943f5917b72d2c74e7ffd4783a053f2264a5ccbb305cd7584
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4cd49ad64b6dfe822613397924717ad6cfc15f73fc5b1ebcb4ad80fead211545
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
5106a4e511706df433181790f4549462307d69dc064ac24e3c3520c201b89611
51d64391f9bce4d81cf455193a136387402901b93e01f9247b8167e051699a0e
52b9e38359d28b25df0896fd56c1fe0e2dfa20e178baab3822213b49a5cdec97
566e363bc630e3298955b0e29b1bde4b259547a223aee5066d160a369aff466e
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
598cfacb2986b2824cdea6498008b647ff7b9aaf6f72c30f990c513a3851c361
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5beed9122f1ef90478c7feb439906e93dc2896604e4f48f24c7403f26cf37f29
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5f9a1d34ccb348e4fd8ebd514000155cb050981ac37b8672dec3cdfe54a494a7
6127975ef8fa442963a10bf206a986d9e78cc0a802bc0062f9e3369ad36eff83
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
6548c08846779f8d18623cade2d7e9d58bbceb302694fd28c3a2da6b2ee91924
66001a51b61fb8dfa893331f43f0fe1606171f57068ee9e31cc0573cafd20c55
6609393ea122a21291adb391b0e2569df37c08df6e9dc4a0a23718ddfa0c6426
661582515dd231f99fdd37d11c1237a8e001ab99b898dc1430ac2f73f718098c
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6b538b22c527e15b62647c3533348500bb8b924c8ad20c2235929d1b3155703c
6c85fcba7deba2ffcb224f52e62ab32c6d5db3310c0e5d1939fdc4554aa77865
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392
73e692ea3d418746a8f3deb127e08cf6aaeaf4bbc244663a12a0359daada31ca
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
779e659ab6020407ece5462b6a7c995dfa2c63373ef87dc17151a92332f8a52f
77bf6cf55ca271a4182754c87d95727d80838cc8cbf3fd0b4bcb8e7345fc1b4c
77cbfc1b6dd1f22f70c6448c0755c40d9203ecf80c617895a9935565981d9b9c
7807bd530ffb903cb81e262166b6720a6f32b87498e5f502d587f18b555532ba
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca
7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
80de6a7413a062cdb81ca1041af8eddaf5bbd9071142b590ab18ce3cd2f18615
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
849a44adfb87a4af1929bb320afc6ed24987d1bb1b587f42fa302f94f3da4741
87ca3135a609706b24d96311da7ca03853cd89ab6478d9128ac9193bb65eb521
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd
8996411a026e31550ae9d27591f1215bd2fde494419437c968ac3db5f1743926
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ad1ba3248ecb0bec23a5d6496c457c07c73dca7d2c350a30cf2bb74a185018b
8bbab7355d5aa551c9f5152fac15aa857d1e352242440ce6911a4e8eef321500
8c33802ba26fad8f15c50e671c35fbce600a669b8cfaa2ade913e54cfa96f8b6
8f3c628048bb8f1f65090540cef37dedb3da8c58713b2d76710c87c9060edde0
917cf9c26937a1463b36e8f38119a6448c29b5f04c4044e10e6900136a77ec89
91f05f0556fabe27de8aa0b613b44b8d4b9a691fe7713b7eecafe34bd03848df
9305c31e4cef1ae42aa3f16b6fa285d0272eaa1cbb19bbaf98067ba98d89d9d6
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
936dc650424e586efd0dd47b9e2073864b0f2d224ba4eeffbe185aabaf545cbf
95a8a0d7c4be2d9e6c9e3e994ee135247f077ff6f2d1919aea45f4a6c2aba7b3
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
9b3d81d93e06d3177fa540cfb18b68c9a0daf92f6f364b4695ac2f93a5007ea4
9b404c617f947b58e4c257e9d622512567b05283f1ce4894b11273982c534f71
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d1cc655fdac69a889568e4a4ea348e343613eec5ed347b5a742303325a43390
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1dc62195a78ed0cfecd916f04549f453c13a90f6d8d67dfc1ce2195ccb20e33
a1e6a90e18e03532611add928ef3529599c27b5a357a8bc78d3fe85d05d9671b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a21cb026de011b49d2443b5d6e3f114a60afc187b7ac7d5153dcf1273ab38807
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a32cf33bba3af043bb0e1c11d53d36400662a9d9b222adb460d0f80bc76ed969
a7bc2ad7ae7eed240bdba54adbc2fd6203ee5f6e2f98a13a6193dec1d45cc18a
a89e086bcbe75d1aaa9b54cc3b572422fd9560d183eb6a456678639812ce5cf2
aaf88fe86c40b3cea4d37f2f787ada13107960700ca77a6325523acad9ee5cf4
ab5d41a2e1ab58cb21919cc930f8f4840f44196bff32c1c14962b9ba8f2015f1
acef9f0144814366d43343ac550898f312205f40d60a5cdee1a93f00c188cc13
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
ad7008f38b04443b67fa33fe00132b2924351f01412c2b89b0dedf900f4a4a3e
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
af2ebee9a7263144c2fe2b80217edd29044f40f190297705492ee9e6f0278d38
af7846155cf04065544b824a60dbc66f1adb852b1c120fce18ebab9b1b33c185
b0ad479caca70c3c54db05714fa242f7ca229d1a4f4425d52249c0751cb49aa9
b105bb3b88371b52236270b355f1657b62bcebb2141a2e67fd6439bf981b1d99
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b88f2c465adfe21abb1f24f9daeb9c6bd8323ae56f19963bd36f9f6c80ea2714
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bb4da3deccd18a04bb7f38fc2fac3a529e7c247d08a6934dcb31a6b8d84dd234
bf690eaccbac5e985eacbaafd7610c9c6984f43cd3a872680f7b1f43af31b278
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c14522a0a27837e68962e3644eb78695517bedf862ca1d6e972af4efcf67027c
c1f4b48cf64b1d62f7ac56e47f4654cc28d949cdb83d9a0fa7be561c498b20d7
c20d204fda0257be992a31867075cd51dbb5428c57e7805ee2fe4a1f08daf500
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6
ca90a7c4d7eab0b46bac622eb16844d85158d9c3b2d5a444eefe98d85608afdf
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cafcc9a51d760f8caf35209bffaa361d8be982ef5018292042d789b8433dd2b3
cb205eb84da54ef1aca36e56124b2ae4cb630cd8f8612d1f4e159260c301327c
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ce138e490f32cd41276c6425da7421d8c917ed0b90430b1abea775134e30e89b
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d0a92a71ae2369c66c9138de52438cbf42b9338d45916089bc1d5f38bd4d65da
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d77c635a1a13072d6e85d634fb142067aa1cec79e9384807af1e556ed86d0c05
d888280a72edc651af08047011eef087b2bc4d09580f91de2ffe09e22a52bdf0
d90d2c88e4b6330329a6947ce91be5e0b74da671819ac9c15883ddcf575c2ef8
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
de5dfbbb6deb54cae10e339cce4fb4b9606fc7b69f4032779f520e0295f745c7
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e4a5264d954871f64c3d8edd2f4dc040fe2c1cc8c02d157f715d073f07ef76b4
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e6302f3f21b30baaa490c9ac8712f1d8f9bc737459853e998d57950c99dcee5c
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ebca949f04795223add59d5c38f384f78ec91f9119be58ef80cb207db692efd6
ec6c461b6a7da1d28c5bb10b93c755c080ccdaed59821bdf1076bdc3866cc956
ee8daf97d63fa07c28a2625b3c76dd63680ffc520b66c754f127f538591910a6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f46d40bf061892a5c2b8eccde5afa89377d576c9bfb637644b9e700b680d141d
f5a884d361385fcd5e67211dc4a330e091df8d28b280f6211cca2ae8b3439ed8
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f849f991a317721d9faba309ac3d3ca2f571e171832b52d3ed77d72e1dc0a0b0
f8617fa330d363023687ae4389f257a923d8650d0c19ce02081c454be4dc2c37
f9071c0948e76f860b54b70d2b49f0ccf6802d581db04131b4b4d955dde43a6b
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473
f9ff6361605f3eb574a6877aa22c0450c88451740cc98bd26c9401da9bf4794a
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fbb26cae740a8b9006ec97fef51427770ef98b2ec043928254af38a56d9ae11b
fd1c9636b43e0e45401b75ec2dd7a918a999ff6fdcbcf8758a15b18f6baeab1a
fd5258a015fd9426f6e30d9e6c27a8531b09c74a63979e991f23ae2749dd7e2f
fe2255e2e70ac6ef64e3873fb73ed5cd8a957ca7fc00355e041069a904b6f377
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

www.zdnet.com Open in urlscan Pro 2.21.36.253 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

419 Requests

99 %HTTPS

32 %IPv6

59 Domains

89 Subdomains

65 IPs

7 Countries

11540 kBTransfer

22666 kBSize

28 Cookies

43 Outgoing links

Redirected requests

419 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.zdnet.com Open in urlscan Pro
2.21.36.253 Public Scan

Screenshot
Live screenshot

Full Image

419
Requests

99 %
HTTPS

32 %
IPv6

59
Domains

89
Subdomains

65
IPs

7
Countries

11540 kB
Transfer

22666 kB
Size

28
Cookies

419 HTTP transactions
13 data transactions