Submitted URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/#ftag=RSSbaffb68|
Effective URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Submission: On October 07 via api from US

Summary

This website contacted 65 IPs in 6 countries across 57 domains to perform 347 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 2.18.233.143 16625 (AKAMAI-AS)
39 2a04:4e42:3::444 54113 (FASTLY)
39 2a04:4e42:1b:... 54113 (FASTLY)
1 23.45.108.200 20940 (AKAMAI-ASN1)
1 35.190.38.167 15169 (GOOGLE)
3 2.18.234.21 16625 (AKAMAI-AS)
7 104.111.214.229 16625 (AKAMAI-AS)
19 172.217.16.162 15169 (GOOGLE)
1 13.32.99.91 16509 (AMAZON-02)
2 34.205.11.82 14618 (AMAZON-AES)
1 216.58.205.230 15169 (GOOGLE)
14 152.199.23.241 15133 (EDGECAST)
1 18 2a00:1450:400... 15169 (GOOGLE)
1 2a01:4a0:1338... 201011 (NETZBETRI...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
4 64.30.230.22 6623 (CBSI-1)
5 34.252.62.73 16509 (AMAZON-02)
3 184.31.90.90 20940 (AKAMAI-ASN1)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
7 151.101.114.133 54113 (FASTLY)
1 2600:9000:20a... 16509 (AMAZON-02)
6 52.20.62.87 14618 (AMAZON-AES)
1 3.225.45.120 14618 (AMAZON-AES)
1 104.111.241.32 16625 (AKAMAI-AS)
2 2 35.190.72.21 15169 (GOOGLE)
2 2 2.18.233.201 16625 (AKAMAI-AS)
2 2 34.250.208.218 16509 (AMAZON-02)
1 18.197.145.83 16509 (AMAZON-02)
1 5 3.248.168.38 16509 (AMAZON-02)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 52.48.237.210 16509 (AMAZON-02)
4 99.80.15.126 16509 (AMAZON-02)
2 54.171.105.8 16509 (AMAZON-02)
5 108.128.130.224 16509 (AMAZON-02)
5 185.33.223.80 29990 (ASN-APPNEXUS)
1 4 66.117.28.68 15224 (OMNITURE)
1 7 2.19.43.224 20940 (AKAMAI-ASN1)
1 4 52.18.214.98 16509 (AMAZON-02)
3 2a03:2880:f02... 32934 (FACEBOOK)
1 104.17.208.240 13335 (CLOUDFLAR...)
1 2600:9000:20a... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 2 66.117.28.86 15224 (OMNITURE)
2 2 172.217.23.130 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 23.99.128.52 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 35.227.208.151 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 151.101.12.134 54113 (FASTLY)
2 2a03:2880:f12... 32934 (FACEBOOK)
5 2600:9000:21f... 16509 (AMAZON-02)
1 35.157.160.140 16509 (AMAZON-02)
22 2.18.235.40 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
8 52.56.89.170 16509 (AMAZON-02)
2 3.85.71.249 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
1 2.16.186.88 20940 (AKAMAI-ASN1)
4 54.159.171.100 14618 (AMAZON-AES)
20 151.101.114.2 54113 (FASTLY)
4 151.101.113.181 54113 (FASTLY)
14 2.16.186.107 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
5 151.101.14.2 54113 (FASTLY)
1 2a04:4e42:1b:... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
347 65
Apex Domain
Subdomains
Transfer
78 cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zdnet1.cbsistatic.com
1 MB
30 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
1 MB
25 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
360 KB
22 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
207 KB
14 akamaized.net
techrepublicmedia.akamaized.net
14 MB
14 googletagservices.com
www.googletagservices.com
391 KB
14 tiqcdn.com
tags.tiqcdn.com
89 KB
11 zdnet.com
www.zdnet.com
urs.zdnet.com
207 KB
10 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
13 KB
9 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
61 KB
9 lightboxcdn.com
www.lightboxcdn.com
api1.lightboxcdn.com
160 KB
9 viglink.com
cdn.viglink.com
api.viglink.com
85 KB
7 scorecardresearch.com
sb.scorecardresearch.com
4 KB
7 demdex.net
dpm.demdex.net
cbsi.demdex.net
6 KB
7 cbsinteractive.com
vidtech.cbsinteractive.com
445 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 chartbeat.net
ping.chartbeat.net
1008 B
6 ml314.com
ml314.com
in.ml314.com
15 KB
5 adnxs.com
secure.adnxs.com
6 KB
4 perfectmarket.com
widget.perfectmarket.com
94 KB
4 omtrdc.net
cbsinteractive.hb.omtrdc.net
1 KB
4 go-mpulse.net
c.go-mpulse.net
58 KB
3 facebook.net
connect.facebook.net
120 KB
3 akstat.io
5f651e6f.akstat.io
0211c814.akstat.io
1 KB
3 tru.am
tru.am
beacon.tru.am
14 KB
3 everestjs.net
www.everestjs.net
8 KB
3 google.com
adservice.google.com
www.google.com
580 B
2 google-analytics.com
www.google-analytics.com
18 KB
2 gstatic.com
csi.gstatic.com
fonts.gstatic.com
13 KB
2 litix.io
inqlnfvog763mmf771rou737u.litix.io
698 B
2 googleapis.com
imasdk.googleapis.com
fonts.googleapis.com
440 B
2 facebook.com
www.facebook.com
323 B
2 disqus.com
zdnet-1.disqus.com
2 KB
2 google.de
www.google.de
adservice.google.de
281 B
2 googlesyndication.com
tpc.googlesyndication.com
2 2mdn.net
s0.2mdn.net
102 KB
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
846 B
2 akamaihd.net
iicbsi-a.akamaihd.net
cbsadsales-a.akamaihd.net
456 B
2 betrad.com
l.betrad.com
240 B
1 jsdelivr.net
cdn.jsdelivr.net
1 KB
1 summerhamster.com
www.summerhamster.com
181 B
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 googleadservices.com
www.googleadservices.com
250 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 azurewebsites.net
lightboxapi2.azurewebsites.net
580 B
1 trackonomics.net
cdn-magiclinks.trackonomics.net
18 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
15 KB
1 adsrvr.org
match.adsrvr.org
537 B
1 eyeota.net
ps.eyeota.net
141 B
1 bluekai.com
tags.bluekai.com
266 B
1 chartbeat.com
static.chartbeat.com
23 KB
1 sharethrough.com
native.sharethrough.com
119 KB
1 indexww.com
js-sec.indexww.com
26 KB
1 evidon.com
c.evidon.com
511 B
347 57
Domain Requested by
27 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
20 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
19 securepubads.g.doubleclick.net www.zdnet.com
securepubads.g.doubleclick.net
www.googletagservices.com
19 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
16 images.taboola.com z.moatads.com
14 techrepublicmedia.akamaized.net vidtech.cbsinteractive.com
14 www.googletagservices.com www.zdnet.com
securepubads.g.doubleclick.net
rev.cbsi.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
12 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
11 px.moatads.com
11 z.moatads.com securepubads.g.doubleclick.net
10 www.zdnet.com zdnet3.cbsistatic.com
vidtech.cbsinteractive.com
8 geo.moatads.com z.moatads.com
8 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
7 sb.scorecardresearch.com 1 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
7 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
vidtech.cbsinteractive.com
6 ping.chartbeat.net www.zdnet.com
5 trc.taboola.com cdn.taboola.com
5 cdn-gl.imrworldwide.com vidtech.cbsinteractive.com
cdn-gl.imrworldwide.com
5 secure.adnxs.com js-sec.indexww.com
5 saa.cbsi.com tags.tiqcdn.com
5 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
vidtech.cbsinteractive.com
5 ml314.com tags.tiqcdn.com
ml314.com
www.zdnet.com
5 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 cbsinteractive.hb.omtrdc.net vidtech.cbsinteractive.com
4 secure-us.imrworldwide.com 1 redirects
4 pixel.everesttech.net 1 redirects
4 api.viglink.com cdn.viglink.com
4 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
4 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
3 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
2 www.google-analytics.com widget.perfectmarket.com
2 inqlnfvog763mmf771rou737u.litix.io vidtech.cbsinteractive.com
2 0211c814.akstat.io c.go-mpulse.net
zdnet1.cbsistatic.com
2 www.facebook.com connect.facebook.net
2 zdnet-1.disqus.com zdnet2.cbsistatic.com
zdnet-1.disqus.com
2 tpc.googlesyndication.com securepubads.g.doubleclick.net
2 cm.everesttech.net 2 redirects
2 s0.2mdn.net zdnet2.cbsistatic.com
s0.2mdn.net
2 as-sec.casalemedia.com js-sec.indexww.com
2 cbsi.demdex.net tags.tiqcdn.com
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 adservice.google.com securepubads.g.doubleclick.net
www.googletagservices.com
2 l.betrad.com www.zdnet.com
1 fonts.gstatic.com www.lightboxcdn.com
1 cdn.jsdelivr.net www.lightboxcdn.com
1 fonts.googleapis.com www.lightboxcdn.com
1 cbsadsales-a.akamaihd.net
1 csi.gstatic.com s0.2mdn.net
1 adservice.google.de www.googletagservices.com
1 rev.cbsi.com www.zdnet.com
1 imasdk.googleapis.com s0.2mdn.net
1 www.summerhamster.com
1 ad.yieldmanager.com
1 www.google.de
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 www.googleadservices.com 1 redirects
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 api1.lightboxcdn.com www.lightboxcdn.com
1 lightboxapi2.azurewebsites.net www.lightboxcdn.com
1 cm.g.doubleclick.net 1 redirects
1 cdn-magiclinks.trackonomics.net tags.tiqcdn.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 5f651e6f.akstat.io zdnet1.cbsistatic.com
1 match.adsrvr.org js-sec.indexww.com
1 beacon.tru.am tru.am
1 ps.eyeota.net www.zdnet.com
1 tags.bluekai.com www.zdnet.com
1 in.ml314.com ml314.com
1 static.chartbeat.com zdnet2.cbsistatic.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 ad.doubleclick.net www.zdnet.com
1 native.sharethrough.com www.zdnet.com
1 js-sec.indexww.com www.zdnet.com
1 urs.zdnet.com zdnet2.cbsistatic.com
1 c.evidon.com www.zdnet.com
347 83
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2019-04-23 -
2020-07-22
a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA
2019-02-22 -
2021-02-26
2 years crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2019-02-01 -
2020-05-02
a year crt.sh
*.zdnet.com
DigiCert SHA2 High Assurance Server CA
2017-12-12 -
2020-12-15
3 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2018-09-18 -
2019-11-17
a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2019-04-25 -
2021-06-24
2 years crt.sh
*.doubleclick.net
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
*.google.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-24 -
2020-03-01
6 months crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
*.ml314.com
Amazon
2019-03-16 -
2020-04-16
a year crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-11 -
2020-03-19
6 months crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA
2018-12-13 -
2020-12-17
2 years crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
odc-prod-01.oracle.com
DigiCert ECC Secure Server CA
2018-12-10 -
2020-03-10
a year crt.sh
*.eyeota.net
Let's Encrypt Authority X3
2019-09-19 -
2019-12-18
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
viglink.com
Amazon
2019-02-09 -
2020-03-09
a year crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2019-06-23 -
2020-09-25
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2019-02-25 -
2020-02-25
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-09-22 -
2019-12-20
3 months crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.trackonomics.net
Go Daddy Secure Certificate Authority - G2
2018-12-22 -
2020-02-20
a year crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.azurewebsites.net
Microsoft IT TLS CA 5
2019-09-24 -
2021-09-24
2 years crt.sh
*.urbanairship.com
DigiCert ECC Secure Server CA
2018-06-20 -
2020-06-24
2 years crt.sh
www.google.de
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2019-12-24
6 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh
*.summerhamster.com
Let's Encrypt Authority X3
2019-09-30 -
2019-12-29
3 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
*.googleapis.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
*.litix.io
Amazon
2019-01-22 -
2020-02-22
a year crt.sh
*.hb.omtrdc.net
DigiCert SHA2 Secure Server CA
2017-12-22 -
2020-01-03
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-03 -
2021-02-22
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-29 -
2020-04-23
a year crt.sh

This page contains 24 frames:

Primary Page: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Frame ID: F2ECE36BD2BAC063B3E13DAACBD06034
Requests: 290 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 8566F464E74FDF957B3565E22A817161
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570456483535&lv=1
Frame ID: 337F354EE35F3280A3FCA48D7216B3B7
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Frame ID: E1DAF09E900B34ED0E579BFEF9FF5337
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 7620B40F249B255AF3C4560231368BC0
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: F8EC07EF0927DDDAD5E6BDB420751234
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: D4C556D5D42DF56EA3918FCC7092FC34
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssonCZu61qP2hsAD0WUyzki8J9rOsVTsQ6TBpcE7Xv6-nbux3tzjZlFGtqrDUhS0xxfAgWJqXMOel72qei5lCHx4dnbE5EODk_Xwfn7BM6HfIzvaxwwD1-YFY-wYxTOdPnYcvJKtFH61z7UDwzrKsAUOUa9zpmVz3Ks6X2ZDlpo_0pfTPfa11Hi58hJwtpqzJUMx63Lo4YZSbk461ySaAWdYxdfZ5ymGleVCZDBbhTQutN6kPFthMoUbae9r7-1cCn1Uw&sig=Cg0ArKJSzMwUMaAL3JnSEAE&urlfix=1&adurl=
Frame ID: 69519625D195C08A83D192F447902908
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscewetlX_ESzab3H8j4VEx6i1TwBOC6hQhkKKrmrhEnhz8i_P6objBFnBROuYzApxNX7XfRFCysWf5--lYQIgeBa0w7K-6mC5WJefRl_19EFbbsTTp2zYr9qkkcwzpV3QfetqD8DyhXUC_2LvW3KI2d87uSznOYHrf9R2EGdAjdmf40Mb3Vor6ZS680V043O6cITVk2ToSHm-VyPltEbutwA_hMfx9ydezBpuhwNV90BiK2-3dTTseUyWtuOaFPMDZ&sig=Cg0ArKJSzA4fQbSjcn-VEAE&urlfix=1&adurl=
Frame ID: 2C98EB9AB2E082CDA834AC45CAC76BA8
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvXFbs5Xwr0t7b_MohcehQOUbKSwWU1QM7nFXZ8fJCT80kGyXh8_6zVQ87EYjFH9nfozNFJJSjyh5ogs9nFnyCz1GfU4NnqjU0Q3VHRQpGVVccV8p00kCVz5Z0I-Pt6pJ-vt2JHRhEfhRm7buKgtSr0iy3SeFZzs8l3wQ8zr6aiOaghEUaC_Y4eCoP2HPXVnz_sfb1of0Q8PNsDu2UFDpuu7wjGFk4hAowYHo6ifOisR-kscg2sSn00QS_xxZk2yDcj2g&sig=Cg0ArKJSzNonlOqlUWPLEAE&urlfix=1&adurl=
Frame ID: 69CE98B8A4B861172B0735EA0968FF07
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfcd1nniUN7WC8LIfaUQfEM2rjmQ_OYtO_Rxlgto5pVYUPAUS6sD37XR_ga41YA8JmmAf-5HgntylON7xN52IXNS9jnU5te41SLSAprVd-Wgecp6mv2yFN2p8vwmaQnjl_VDbAVWeRDtD2oafgdtL4ioAgOht6_qc-_w5PUEvkcJFlGmOChyahCTOHZqehZ1TRrhFvOUIj-knKkfen4KOmE8N7ijbYrZ4pENlIX8raTFd7Z_2Iy7pAr4jsWqzpAlXXYA&sig=Cg0ArKJSzNacnIMhmvROEAE&urlfix=1&adurl=
Frame ID: 25153EC310ABF9AC19BF32656C29F2BF
Requests: 4 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.338.1_en.html
Frame ID: EA6DF565AA1AC5EF91B105696F560EFF
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstjTT507j4bDPACVJ8YwraH1EV8kTjpM7dx4TUqELViXhtwbPiyNsU3pKejV5b2pcGNS3KSOoQXGFUdfMTo201y8WMRlXXjgs3x7QAi6sbZEsrkV9yYSQGZXCT4kRbszG72xpLKSMIgBhzzGvyfg4y_68UhcZ_a6RPFKXwi_dJyexfTFnV0d0K2YOhvNypCkCt86VXxQunAceSVqBZ3TYstFvDBunS6A-cPbq0mJAwAqB2ED8uhf8HJ1y_LjjsZXFPPYQ&sig=Cg0ArKJSzOK9yW-ZZWBOEAE&urlfix=1&adurl=
Frame ID: 5B7C21B43F7D0D148565B93D95962C51
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu2Q1c_SMI7KqXxB8D3AiNiq-GHavScaoKn6_9xC9wyNl40IW3PdTh8xp3U_AZiArTxcDh0wWNV47WHpqvVzchr7Yz6xHTWTeAAfNn5Wft1575nNA_8-j93Ju9gr-KBuK4IknCT9oNLzZOCD8nniW3G35STWeZLW6g2x1xJPI0sOoTAAYHWtn3BGEanoqorqkkGDZasa_Rvgum01qpPEieGF_cBugf3UtagUCpfH_c1k6n1cOhZ4BKSLe2cjmVVHP0Hvw&sig=Cg0ArKJSzCdFiK_U4_BDEAE&urlfix=1&adurl=
Frame ID: ADA357EB00AFD9A564B3641A8F5279F1
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJOuQpHpM217ei5cAbYPX0J9BYzAbr7WViNmvrNL_nM_OT4J3Cjyu4ZSjMRhkck9MLAKjRhqj0lV5Rq9UBdGe58FoJHylVL2HOAYUnIX71LLVfCpb0kq_Gdb-xHYqWdr_JR8YhC4NwYpcfe4jn1q5_oZDMSEoTHdXohUq2vBjvIL7rcVp06Y-5_cd6jIJI92JcFs_nmuZEGSRacdG_mSEfjsvr5ARQJyGt468BNYX2QIYvojeKMoUIjZqvT0xtZwY48g&sig=Cg0ArKJSzETFjftrxK9LEAE&urlfix=1&adurl=
Frame ID: 7E4F1AE4AC6C25215089652AD22D03EA
Requests: 13 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CCA51DC6A0F794ACE28C219549CFF847
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 2AA4D241BE7CD62D8B87FF77869F45D7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsumjBqpdp5L_aV1WH_usi_uSMmZk6DF3cVd-u_RdwqF6PQeawiDTuLKj-_r0_hu8o6cqtbbj52-Lk7xLK33xVsYgFLzFk8l-9dVMgntWGvjsMSiracWEZaRs074h4m6UlLicxIfpZ-Vych_6ZRKNbmq9sBehTGeBdCOksVhSEwB70UEFOS2y0_4b3by3-LQYQL9f0xZIR0miWt_Zs39jNSRgPf_bpCs7UtE5ycT1nVuQnmwE702AQMdsOjiizqZQTKK1g&sig=Cg0ArKJSzLIXcJYYgfYqEAE&urlfix=1&adurl=
Frame ID: 70A582A0524EB020F14AFB90F2B13E1F
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4GjusqwNTbIiDl_5C285CUMjon-NDa3I_txpCPqtYFMk7tN6qyyeqoaHClJ_6nLUwB3bHRT2puXo3H_B_bQ8dFwHwX9BpN_zZJH5oPodYUb57TQ1QEJ14O80hyZg-lpbFX88a_cU56n9p8GCgxm1dSaLZ0ez9YV1e0luZaxa8lsRyoMJy82zQQO0-G2tpi3vpy1B3nBc4ji3XjmkAaqWNima5rQ2T5JT6At2PIXQXR5n0i_vnxUpAlGr32YFnxd6PJQ&sig=Cg0ArKJSzM4oAwPckLaPEAE&urlfix=1&adurl=
Frame ID: 3583B725715687A5F3004FBDEDCD8F36
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvxcCi8O0aLYhha7h2draWsT_2M_gGf-bcDdebjNnJnhNfWwwNMykmBBjCVmfwLcuXgCm3HWFKOOzNMau0xP0Hug8fB3UIlWXKTSVTAakRxmReDPH47ny3XQv8jjCyrNYHZuvTNVpsr0OudHjyW7be3ta7becZmNQnmDPS5ctZ1aKJcGu9KieU3bd8dGm-tVIU6CRn7FBwy53Gxi7ZdON-vAoFO3IaiuiJBcsJtJfkE8MfgkbPNINZhLdcUSXw3ODESWA&sig=Cg0ArKJSzO3VviLawRvdEAE&urlfix=1&adurl=
Frame ID: 7EEF44BAA457E2AB90BDE366305FA035
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuYux7hRWHLG9eu0fjjvZG9Cwub1CcZIvV4yn8xuNLXK_87HDD6M-ykuiJHlY-CYI0Gj5GQY8YedXvado2wO4tdy-tFS7XnNVua6sPCchVVAImbuboakPveWHJdUuisDkqeVimpt4YtxOB62r2Zd0mMRmCqjdt6aE_sYDYzIB6STN8mrpnDfHcHGcfnfWgn_DhmMvaTbhtgHcnGVrMLxx-jnBaOdXUM1y4pxvAh4swjcBwIsQyT5Zfrd-nFdbSP60_Nw&sig=Cg0ArKJSzGiX5ivJ4OywEAE&urlfix=1&adurl=
Frame ID: 39A5D6712C21AF3F84B0057356FD38DC
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 1DC4CB7F1678EFF97EF96866BCC24D5E
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 172912E0ED7B2DA372E95AC57A6BFA96
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Frame ID: C22FFA8127E92120420213ADCE11A91D
Requests: 3 HTTP requests in this frame

Screenshot


Page Statistics

347
Requests

99 %
HTTPS

34 %
IPv6

57
Domains

83
Subdomains

65
IPs

6
Countries

18993 kB
Transfer

28546 kB
Size

31
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151505733031935 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTUwNTczMzAzMTkzNRAAGg0Io4ft7AUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=3afc96f580c0183a547f811c774fb8e75ef00d83d2a4c7802adc27e31aa6aca5f4cb09cee1a4f8eb&person_id=5978151505733031935&eid=50082
Request Chain 83
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151505733031935%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151505733031935%26eid=50220&mm_bnc&mm_bct&UUID=08a35d9b-3a70-4200-b265-6d5aee79f665 HTTP 302
  • https://ml314.com/csync.ashx?fp=08a35d9b-3a70-4200-b265-6d5aee79f665&person_id=5978151505733031935&eid=50220
Request Chain 84
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151505733031935 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151505733031935 HTTP 302
  • https://ml314.com/csync.ashx?fp=d1b7c2cf98f78013966624034f2ded8e&eid=50146&person_id=5978151505733031935
Request Chain 86
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151505733031935&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151505733031935&redir=
Request Chain 111
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 132
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c9=
Request Chain 133
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570456484579 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570456484579&ja=1
Request Chain 146
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFp0RHBBQUFCRGZMclRyeQ HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEFmvqS3OMFHGPJ-ENu0lsXQ&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 158
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=pEObXaS_MpD1gAe0v4aQBQ&random=634025933&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351&ipr=y

347 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
467 KB
110 KB
Document
General
Full URL
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
645a9e0e0cd355bb6bbae04a4bb1146050bc76228360a4679f1f7af51b676322
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
expires
Mon, 07 Oct 2019 15:15:09 GMT
last-modified
Mon, 07 Oct 2019 13:45:09 GMT
cache-control
max-age=5400, private
server
nginx
content-type
text/html; charset=UTF-8
x-tx-id
64db8332-39f4-466f-9444-5b0f34653f60
x-xss-protection
1; mode=block
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options
SAMEORIGIN
access-control-allow-origin
https://www.zdnet.com
content-encoding
gzip
accept-ranges
bytes
content-length
111597
date
Mon, 07 Oct 2019 13:54:42 GMT
set-cookie
fly_device=desktop; expires=Mon, 14-Oct-2019 13:54:42 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "nl"}; expires=Mon, 14-Oct-2019 13:54:42 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary
Accept-Encoding, User-Agent
strict-transport-security
max-age=63072000; includeSubDomains; preload
main-a78f3c243e-rev.css
zdnet2.cbsistatic.com/fly/1814-fly/css/core/
355 KB
64 KB
Stylesheet
General
Full URL
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
58c3593e62aeda27dc92790ddb33fd7ff8cfb0f7a9c154bc9ebad50afc2dd764
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425500
status
200
vary
Accept-Encoding
content-length
65260
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:38:02 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c45a-58a01"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:02 GMT
controls-b84eef3a0e-rev.css
zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/
41 KB
7 KB
Stylesheet
General
Full URL
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-b84eef3a0e-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
bf069cddda8cd2b6740b460e576c56eaa88cc2e939d8d764b99fa4b87f26ffad
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425499
status
200
vary
Accept-Encoding
content-length
6563
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:38:16 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c468-a53d"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:02 GMT
charlie-osborne.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/
893 B
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/charlie-osborne.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
92441e9d3e45785e3b558bd6db3363dd99676eba60e2cbf47569e4cbbb658139
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
x-content-type-options
nosniff
age
6302577
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
893
x-xss-protection
1; mode=block
last-modified
Thu, 19 Jan 2017 17:01:16 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 25 Jul 2020 14:19:28 GMT
cybersecurity-clicking-email-links-could-5d7772bc26d15a0001ff40bc-1-sep-10-2019-11-53-23-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/10/aa1ef608-7239-4ab0-8603-4c9dcb2a0f79/thumbnail/570x322/696254811f1f45afdb68c22bba23f4b9/
21 KB
21 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/10/aa1ef608-7239-4ab0-8603-4c9dcb2a0f79/thumbnail/570x322/696254811f1f45afdb68c22bba23f4b9/cybersecurity-clicking-email-links-could-5d7772bc26d15a0001ff40bc-1-sep-10-2019-11-53-23-poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
dd19af5895b698fd5945fa6ed945adaacde4d116f356a9cdfd7375dbbac4d540
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3098
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
21242
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"2c35aee2e3a2410da6736f221f36498d"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
advertisement.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/
53 B
194 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
254572
status
200
vary
Accept-Encoding
content-length
71
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c3bf-35"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 11 Oct 2019 15:11:50 GMT
screenshot-2019-06-10-at-14-21-26.png
zdnet1.cbsistatic.com/hub/i/r/2019/06/10/cbaea501-1805-4e57-8395-d6aea4f4e01f/thumbnail/170x128/a08ada47f2f6b79d159823acd2898ca7/
39 KB
39 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/06/10/cbaea501-1805-4e57-8395-d6aea4f4e01f/thumbnail/170x128/a08ada47f2f6b79d159823acd2898ca7/screenshot-2019-06-10-at-14-21-26.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8e7e2d3d1771e4dc117eb74bf3d42c79b335c009d4726ce643887a3a53c5c18c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6280854
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
39732
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"942a764a025ebb9250882be951b58743"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-22-25.png
zdnet4.cbsistatic.com/hub/i/r/2019/06/10/100d8975-ffde-4412-9dce-d401859f59d0/thumbnail/170x128/85ba77a6dfb8c845cdb59565ad39b2e1/
52 KB
52 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/06/10/100d8975-ffde-4412-9dce-d401859f59d0/thumbnail/170x128/85ba77a6dfb8c845cdb59565ad39b2e1/screenshot-2019-06-10-at-14-22-25.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1ee4eed540fc7f36bc9a6e509a151ff3e5c6531f0013cb211d92f887d67e0b5
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2616041
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
53289
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"25404ffb065b2e1b8a04f9f3410965bb"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-23-18.png
zdnet1.cbsistatic.com/hub/i/r/2019/06/10/29c0eb3c-54ac-42e7-a54e-83fcf260cafb/thumbnail/170x128/63996297331aaffcb3e9c93e99b58ffa/
44 KB
44 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/06/10/29c0eb3c-54ac-42e7-a54e-83fcf260cafb/thumbnail/170x128/63996297331aaffcb3e9c93e99b58ffa/screenshot-2019-06-10-at-14-23-18.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5e08810ff7057c4c712c70508b6e823fe5e8391df08c1e54d1adac3d717d3740
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
186726
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
45080
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"8d497e638156b68197ed9ad0978eaeaf"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-24-27.png
zdnet1.cbsistatic.com/hub/i/r/2019/06/10/c97bc941-cee7-4b01-97d3-a78a8d58176b/thumbnail/170x128/2d0416cce336ff74f5f42aa92951e373/
27 KB
27 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/06/10/c97bc941-cee7-4b01-97d3-a78a8d58176b/thumbnail/170x128/2d0416cce336ff74f5f42aa92951e373/screenshot-2019-06-10-at-14-24-27.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c7b5bf6afade0743dea9bc779c6e3be2a316c37efbe18b694d4c9e04b1318139
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6258345
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
27392
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"604ee6361f8a853c947ede4e3c9da372"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-25-20.png
zdnet2.cbsistatic.com/hub/i/r/2019/06/10/e1dbb9f5-0a3e-447d-b85a-0cdcb91e4a8c/thumbnail/170x128/1eff508e2e476488bfd81198ea4ea322/
37 KB
37 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/06/10/e1dbb9f5-0a3e-447d-b85a-0cdcb91e4a8c/thumbnail/170x128/1eff508e2e476488bfd81198ea4ea322/screenshot-2019-06-10-at-14-25-20.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
179d9e97f3d778f624821f22886ffa64e62e08b7a8d99cf2fec8051ed9449c0e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1678860
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
37845
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"e8225c0d3f6c94b352fe73af1f66737d"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
womanlaptopistocka-1158269371.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/07/3267b84f-65ca-4f79-955f-4cfbe000b2cc/thumbnail/170x128/d8744513d5c5a3080b135f0998c9e7d5/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/07/3267b84f-65ca-4f79-955f-4cfbe000b2cc/thumbnail/170x128/d8744513d5c5a3080b135f0998c9e7d5/womanlaptopistocka-1158269371.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
7fbfeaaaa646ba2dd49c23a6996d50ab1d941193ae390f6bd8cedef6db298951
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2692
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4859
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"2dfe1946b3003933b7f8ddd71f24dbb1"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
fbi-thumb.jpg
zdnet3.cbsistatic.com/hub/i/r/2017/01/18/00bf55fe-816b-45fe-b682-a5562779b905/thumbnail/170x128/5c8ac73c9489992ed8e86de0b0e1ac4f/
6 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2017/01/18/00bf55fe-816b-45fe-b682-a5562779b905/thumbnail/170x128/5c8ac73c9489992ed8e86de0b0e1ac4f/fbi-thumb.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
dd4d1a01ff58cd429ad4dfe605df019c609e4bfca2cf6970b4dca4d2aa2e20a3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5934
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5915
x-xss-protection
1; mode=block
last-modified
Wed, 18 Jan 2017 16:47:43 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Oct 2020 12:15:48 GMT
handslaptopistock-1169476443.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/07/f9237424-679a-4e4e-bd88-173344a2a3bd/thumbnail/170x128/9fed010fa5c472ca61a70bbb740a811a/
8 KB
7 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/07/f9237424-679a-4e4e-bd88-173344a2a3bd/thumbnail/170x128/9fed010fa5c472ca61a70bbb740a811a/handslaptopistock-1169476443.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
bf6221fb8bc8205f50c1e5c9e442a686aaf8606f67b30dc85a76f3e7d67b32a8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10206
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7285
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"46dce5f2f0e61edb70931a00d00a464e"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-07-at-09-23-25.png
zdnet3.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/170x128/cd31022181efb1997cceb145b24dc069/
31 KB
32 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/170x128/cd31022181efb1997cceb145b24dc069/screenshot-2019-10-07-at-09-23-25.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0f33f072e8b10579a36622bc37a8ce983f16fe459e2a51dffbb9dd2f46eb137c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
16165
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
32138
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a4700f244723a6277a576f50af1d387b"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
china-apt17.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/07/24/596bdb15-1b31-405c-a074-d0a23a40d880/thumbnail/170x128/577fd98716e32ea099e08b27011bcefa/
9 KB
8 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/07/24/596bdb15-1b31-405c-a074-d0a23a40d880/thumbnail/170x128/577fd98716e32ea099e08b27011bcefa/china-apt17.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa418fc9669041ac1047f8acc1b90ee68e465e99e7d857d0eb2618401f15de7b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
60855
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
8207
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"e6051b3bfe716cc4a38c2f39ec199873"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
dns-over-https.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/06/196fd31d-54d9-4e52-a1e2-7e050fdf8f3e/thumbnail/170x128/71fb5a46a98299cae7283235bc7465b9/
22 KB
22 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/06/196fd31d-54d9-4e52-a1e2-7e050fdf8f3e/thumbnail/170x128/71fb5a46a98299cae7283235bc7465b9/dns-over-https.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d9bddfba9cda4714a735ec84b0a89517be57b0e71cd2576db2ef5fab9181b3c9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
76698
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
22751
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f8ed6ae9447fdf0d0827719282addc60"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock000037417830medium.jpg
zdnet1.cbsistatic.com/hub/i/r/2015/09/22/f84915b2-0153-490a-ab2e-01e2ca4a13d3/thumbnail/170x128/f6df4da5b62de14d9e76c000b1ea329c/
7 KB
7 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2015/09/22/f84915b2-0153-490a-ab2e-01e2ca4a13d3/thumbnail/170x128/f6df4da5b62de14d9e76c000b1ea329c/istock000037417830medium.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
67a2abf9c5f0456b687a94963dd4cf6643910c7093b086c29ce0937c3fc9b2de
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
100315
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
6720
x-xss-protection
1; mode=block
last-modified
Thu, 11 Feb 2016 04:14:19 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 05 Oct 2020 10:02:47 GMT
signal-new.jpg
zdnet3.cbsistatic.com/hub/i/r/2017/02/23/aeac0734-7ab8-49a7-88d0-5ecc90ac73fe/thumbnail/170x128/5fc47c5f31caf0382442be459b578e4d/
5 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2017/02/23/aeac0734-7ab8-49a7-88d0-5ecc90ac73fe/thumbnail/170x128/5fc47c5f31caf0382442be459b578e4d/signal-new.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
617bf7027ce458fe938f229d2e60f6b85ed5e38ab3a5bf65f39dae73179e60f4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
230668
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4897
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"9d03333181fb0f6bd495e8b157259880"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
urgent-11.png
zdnet3.cbsistatic.com/hub/i/r/2019/07/28/8ac197ce-5afd-49d6-98e9-9bcbfb19cdc6/thumbnail/170x128/4ce5ed56d5379cb18964b1d0569af995/
21 KB
21 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/07/28/8ac197ce-5afd-49d6-98e9-9bcbfb19cdc6/thumbnail/170x128/4ce5ed56d5379cb18964b1d0569af995/urgent-11.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
7c7cbe8dfdb766a1ffdacb2de13f5bb889df31698565a8be5fb23c426596d4f1
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
240085
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
21043
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"cad22bbf0e122b133c9ce941b80831e9"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1814-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425500
status
200
vary
Accept-Encoding
content-length
6305
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:59 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c457-3f09"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:02 GMT
evidon-sitenotice-tag.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
69 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
468883
status
200
vary
Accept-Encoding
content-length
13960
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:02:29 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d936a85-1134e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 03:39:58 GMT
country.js
c.evidon.com/geo/
260 B
511 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.45.108.200 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-108-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
last-modified
Wed, 30 May 2018 22:22:39 GMT
server
AkamaiNetStorage
status
200
etag
"8d3bb7b8708f6911ebe937e111b09ec4:1527718959"
access-control-max-age
86400
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
accept-ranges
bytes
access-control-allow-headers
*
content-length
260
snthemes.js
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
94 KB
8 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
163032
status
200
vary
Accept-Encoding
content-length
7763
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-177f3"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 12 Oct 2019 16:32:42 GMT
settings.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
33 KB
2 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
552325
status
200
vary
Accept-Encoding
content-length
1669
x-xss-protection
1; mode=block
last-modified
Mon, 30 Sep 2019 12:27:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d91f4b6-828e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 04:24:39 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
mag-white01.png
zdnet3.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/
1 KB
1022 B
Image
General
Full URL
https://zdnet3.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425499
status
200
vary
Accept-Encoding
content-length
936
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-4f1"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:02 GMT
ring-animated.svg
zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/video/
704 B
483 B
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/video/ring-animated.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-b84eef3a0e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425497
status
200
vary
Accept-Encoding
content-length
364
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c3bf-2c0"
strict-transport-security
max-age=31536000
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 01 Oct 2020 15:43:04 GMT
Raleway-Bold.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
51 KB
51 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
x-content-type-options
nosniff
age
6566551
status
200
vary
Accept-Encoding
content-length
52212
x-xss-protection
1; mode=block
last-modified
Tue, 23 Jul 2019 09:13:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d36cfc5-cbf4"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jul 2020 12:03:46 GMT
Raleway-Light.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
x-content-type-options
nosniff
age
7156068
status
200
vary
Accept-Encoding
content-length
51608
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-c998"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
Raleway-Regular.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
50 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
x-content-type-options
nosniff
age
3315880
status
200
vary
Accept-Encoding
content-length
51572
x-xss-protection
1; mode=block
last-modified
Thu, 29 Aug 2019 19:30:36 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d6827dc-c974"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 29 Aug 2020 04:43:37 GMT
logo.png
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425499
status
200
vary
Accept-Encoding
content-length
4128
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-1009"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:02 GMT
en.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/
311 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
53429
status
200
vary
Accept-Encoding
content-length
14353
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:57 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c455-4ddff"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 13 Oct 2019 23:02:51 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1814-fly/js/
209 KB
69 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
15102dc05e413115725f527ef7a26007562147b84910f3aa2b589d4ca52b114d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425499
status
200
vary
Accept-Encoding
content-length
70772
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:38:01 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c459-342bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:03 GMT
vendorlist.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
113 KB
51 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
313609
status
200
vary
Accept-Encoding
content-length
52305
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:57 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c455-1c3b9"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 10 Oct 2019 22:46:03 GMT
urs.js
urs.zdnet.com/sdk/
50 KB
50 KB
Script
General
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
ls-zdnet.js
js-sec.indexww.com/ht/
85 KB
26 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 13:50:33 GMT
Server
Apache
ETag
"76391a-15269-5945255efc6a4"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26184
Expires
Mon, 07 Oct 2019 14:54:43 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 8566
187 KB
55 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
securepubads.g.doubleclick.net/tag/js/
44 KB
14 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
a91b3063e3d9f65e4445162917ae5ff4cd9914ef9fc1ff2e709c0b6d7da48724
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"301 / 183 of 1000 / last-modified: 1570118832"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14350
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:43 GMT
sfp.js
native.sharethrough.com/assets/
422 KB
119 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.99.91 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-99-91.prg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
11dea3c83c430d0de8ddeb8b5d46c309fe476723f645647b0a6dc0efbc3f6fd3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:51:01 GMT
content-encoding
gzip
last-modified
Fri, 04 Oct 2019 16:32:46 GMT
server
AmazonS3
x-amz-cf-pop
PRG50
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
v3H0uMGiSQt3RXmmCCww5spDYgQ2GwsLvECktbyRN0vcMM1MVFagWQ==
via
1.1 6207b951a11da0467241aea4294b753b.cloudfront.net (CloudFront)
expires
Fri, 04 Oct 2019 17:32:44 GMT
evidon-banner.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
8 KB
2 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
468852
status
200
vary
Accept-Encoding
content-length
2440
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:04:58 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d936b1a-1faf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 03:40:12 GMT
18863
l.betrad.com/site/v3/425/3445/8/1/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/8/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-11-82.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
;ord=1570456483309
ad.doubleclick.net/ddm/ad/tiqsfhun/ssqkvtnpmeg/uxouri/
43 B
551 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/ad/tiqsfhun/ssqkvtnpmeg/uxouri/;ord=1570456483309?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s24-in-f230.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
scrolling-mpu-22779a851e-rev.js
zdnet3.cbsistatic.com/fly/js/components/
956 B
599 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
423214
status
200
vary
Accept-Encoding
content-length
491
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c451-3bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 16:21:08 GMT
18863
l.betrad.com/site/v3/425/3445/8/4/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/8/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-11-82.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
93 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DD6) /
Resource Hash
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Mon, 16 Sep 2019 18:11:12 GMT
server
ECAcc (lha/8DD6)
etag
"4063075910"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19393
expires
Mon, 07 Oct 2019 13:59:43 GMT
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019093001.js
securepubads.g.doubleclick.net/gpt/
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
7c5e8ae97d184389610b4deeab367ea2bcbe2108fd50b622546240eadc847a89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Sep 2019 13:06:17 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58932
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:43 GMT
config.json
c.go-mpulse.net/api/ Frame 8566
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5234855&v=1.571.0&if=&sl=0&si=m4swlmfblsd-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d86b322bbac503e6f32dbbd43e24a10ebed508c76c1b0e0e4b1e76868fba36d4

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
694
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
22 B
272 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a01:4a0:1338:28::c38a:ff11 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Cache-Control
max-age=101376
Server
AkamaiNetStorage
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
78 KB
28 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1795152
cf-ray
52205e5dfcebcba4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Mon, 07 Oct 2019 14:24:43 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D41) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECAcc (lha/8D41)
etag
"392561602+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DED) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECAcc (lha/8DED)
etag
"3447796852"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8CA1) /
Resource Hash
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Wed, 04 Sep 2019 18:05:01 GMT
server
ECAcc (lha/8CA1)
etag
"3504427907"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48569
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
957 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D49) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D49)
etag
"2267415266"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D62) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (lha/8D62)
etag
"3334871598"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8C92) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECAcc (lha/8C92)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Tue, 22 Oct 2019 13:54:43 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
968 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D56) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECAcc (lha/8D56)
etag
"1907756232"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Tue, 22 Oct 2019 13:54:43 GMT
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 337F
326 B
550 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570456483535&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
192a41b3a2ef7d13301354b3131babb5890472f61ebf9dbff4b461903ec719c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
587931
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
52205e5e5e5f8c74-VIE
pixel.gif
cdn.viglink.com/images/
43 B
265 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=3.0934751039398973
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
cf-cache-status
HIT
age
9
cf-ray
52205e5e3d75cba4-VIE
status
200
content-length
43
x-amz-id-2
byIESWjZ26LmaQnvdZ6MAkOHeseLnXRMIoey2mnuKyyc7/qxMnBtjp4a+4vmMhYtkt4EbPnvBIE=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
7C008DC6E3D36B66
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
pixel.gif
cdn.viglink.com/images/
43 B
103 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=3.0934751039398973
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
cf-cache-status
HIT
age
9
cf-ray
52205e5e3d77cba4-VIE
status
200
content-length
43
x-amz-id-2
byIESWjZ26LmaQnvdZ6MAkOHeseLnXRMIoey2mnuKyyc7/qxMnBtjp4a+4vmMhYtkt4EbPnvBIE=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
7C008DC6E3D36B66
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
01b9849922214670b387ade1904a0b76143ea147887b6197b21b4c1e1ff654c3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Apache/2.4.25
Etag
Zp7uuV2bQ6OxZaj2eTs.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=558
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
tag.aspx
ml314.com/
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?792019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.252.62.73 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-62-73.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:42 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 06:50:07 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=60923
Connection
keep-alive
Content-Length
11933
Expires
Tue, 08 Oct 2019 06:50:07 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=506
Content-Length
6423
Expires
Mon, 07 Oct 2019 14:24:43 GMT
st.v3.js
www.everestjs.net/static/
25 KB
7 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Aug 2019 09:05:18 GMT
Server
Apache
ETag
"1ff0663-624a-58fe7d2af0fea"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=69070
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7175
Expires
Tue, 08 Oct 2019 09:05:53 GMT
cbsinteractive.js
tru.am/scripts/custom/
3 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
br
cf-cache-status
MISS
x-guploader-uploadid
AEnB2UqZKA-j3C2Gr8ooOADUV-WX6RvCswRSgGqskP2djIRRVR6Z3aTs6ajqYqiAlpMA1unPPY87SoZEWBytBRLpEnRkgKnK1g
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Tue, 30 Apr 2019 19:32:26 GMT
server
cloudflare
etag
W/"c486c91d1321adf59073588524182108"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation
1556652746634603
cache-control
public, max-age=86400
x-goog-stored-content-length
2725
cf-ray
52205e5e9c7a8c86-VIE
expires
Tue, 08 Oct 2019 13:54:43 GMT
article-2cfdba3ef4-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
160 KB
45 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-2cfdba3ef4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8712d548c2bf72289213c2eca9bcdd1e94c766bf9cf4653c422e91e07882f310
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
513331
status
200
vary
Accept-Encoding
content-length
45972
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:05:06 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d936b22-28162"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 15:19:11 GMT
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 337F
762 KB
124 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570456483535&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
qP10qPK8evED/0zxduUG5Q==
age
587931
cf-polished
origSize=1198838
status
200
last-modified
Mon, 23 Sep 2019 18:35:07 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
7c4704d7-501e-003e-7e3d-72e3e0000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
52205e5e8e7e8c74-VIE
expires
Tue, 06 Oct 2020 13:54:43 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/
1 MB
281 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
age
3477089
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by
cache-dca17747-DCA, cache-hhn4046-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1570456484.685955,VS0,VE0
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
F767A360D0453B01
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 34
chartbeat_video.js
static.chartbeat.com/js/
66 KB
23 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat_video.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20ac:9a00:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:13:31 GMT
content-encoding
gzip
last-modified
Thu, 01 Aug 2019 01:36:07 GMT
server
nginx
age
2471
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
PRG50
x-amz-cf-id
fgx45eF-RXzF0XscNfERxYRwaMewcG6HAjjoDcVYip0BYckiM37Y_A==
via
1.1 1b1536679e81d123b6aca645be2c5b38.cloudfront.net (CloudFront)
expires
Mon, 07 Oct 2019 15:13:31 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
257711
status
200
vary
Accept-Encoding
content-length
4877
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:59 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c457-2fdf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 11 Oct 2019 14:19:32 GMT
fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
q4B4xYJoZwx9ikt94o1nCA==
age
587930
cf-polished
origSize=6016
x-ms-meta-cbmodifiedtime
Wed, 10 Apr 2019 18:50:43 GMT
status
200
last-modified
Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
a8c06077-501e-007a-013d-723f8c000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
52205e5efeba8c74-VIE
expires
Tue, 06 Oct 2020 13:54:43 GMT
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame E1DA
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
cookie
__cfduid=d6cf56bcbf8052fede99533e345f920991570456483
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
200
date
Mon, 07 Oct 2019 13:54:44 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-request-id
f13ec7dc-701e-0083-4916-7df56c000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
MISS
expires
Tue, 06 Oct 2020 13:54:44 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
52205e5efec18c74-VIE
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/
35 B
256 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1570456483666&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:43 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
284008
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
52205e5efebf8c74-VIE
cf-bgj
imgq:85
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1570456483671&s=ae4cf778cc3af1c3e977ff3fbf62240526d6b5da5ead609adf7dc0df73aacaa2
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3b3d2e1a462539b0f2ae9310286eb7525e9c4c5f87e29140dbf3ea8b8b7db536

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
801
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&u=CWJvBpBbICeECR3Ifi&d=zdnet.com&g=65713&g0=security&g1=charlie%20osborne&n=1&f=00001&c=0&x=0&m=0&y=3735&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=924&t=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&V=116&i=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&tz=-120&_acct=anon&sn=1&sv=FpLz0D1h3-XIjNBpCq0Zv-Cgdg2s&sd=1&im=067b2ff3&_
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&pv=1570456483745_hvbbdharo&bl=en-us&cb=1967266&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1570456483745_hvbbdharo&cid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?792019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.252.62.73 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-62-73.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5503ef6076611a5b5871f26582a57f30f11004a366e1da3eed377e760df5c597

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
521
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=792019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?792019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.45.120 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-45-120.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Tue, 08 Oct 2019 13:54:44 GMT
20486
tags.bluekai.com/site/
0
266 B
Image
General
Full URL
https://tags.bluekai.com/site/20486?limit=0&id=5978151505733031935&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151505733031935%26eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.241.32 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-32.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
BK-Error
NoCountryCode
Connection
keep-alive
X-N
S
Content-Length
0
BK-Server
d872
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151505733031935
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTUwNTczMzAzMTkzNRAAGg0Io4ft7AUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=3afc96f580c0183a547f811c774fb8e75ef00d83d2a4c7802adc27e31aa6aca5f4cb09cee1a4f8eb&person_id=5978151505733031935&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=3afc96f580c0183a547f811c774fb8e75ef00d83d2a4c7802adc27e31aa6aca5f4cb09cee1a4f8eb&person_id=5978151505733031935&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.252.62.73 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-62-73.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Tue, 08 Oct 2019 09:54:44 GMT

Redirect headers

date
Mon, 07 Oct 2019 13:54:44 GMT
via
1.1 google
status
307
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ml314.com/csync.ashx?fp=3afc96f580c0183a547f811c774fb8e75ef00d83d2a4c7802adc27e31aa6aca5f4cb09cee1a4f8eb&person_id=5978151505733031935&eid=50082
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151505733031935%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151505733031935%26eid=50220&mm_bnc&mm_bct&UUID=08a35d9b-3a70-4200-b265-6d5aee79f665
  • https://ml314.com/csync.ashx?fp=08a35d9b-3a70-4200-b265-6d5aee79f665&person_id=5978151505733031935&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=08a35d9b-3a70-4200-b265-6d5aee79f665&person_id=5978151505733031935&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.252.62.73 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-62-73.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Tue, 08 Oct 2019 09:54:43 GMT

Redirect headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
MT3 1734 ed2a032 master zrh-pixel-x16
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=08a35d9b-3a70-4200-b265-6d5aee79f665&person_id=5978151505733031935&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Mon, 07 Oct 2019 13:54:42 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151505733031935
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151505733031935
  • https://ml314.com/csync.ashx?fp=d1b7c2cf98f78013966624034f2ded8e&eid=50146&person_id=5978151505733031935
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=d1b7c2cf98f78013966624034f2ded8e&eid=50146&person_id=5978151505733031935
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.252.62.73 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-62-73.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Tue, 08 Oct 2019 09:54:44 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:43 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=d1b7c2cf98f78013966624034f2ded8e&eid=50146&person_id=5978151505733031935
Cache-Control
no-cache
X-Server
10.45.8.63
Connection
keep-alive
Content-Length
0
Expires
0
pixel
ps.eyeota.net/
0
141 B
Image
General
Full URL
https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.197.145.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-197-145-83.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:43 GMT
Cache-control
private
Content-Length
0
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151505733031935&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151505733031935&redir=
42 B
776 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151505733031935&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.168.38 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-248-168-38.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v045-0c6014839.edge-irl1.demdex.com 5.59.0.20190904135845 2ms (+1ms)
Pragma
no-cache
X-TID
uXifs0y8R8A=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
X-TID
l8Awxw2HSVA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151505733031935&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ta-pagesocial-sdk.js
tru.am/scripts/
35 KB
12 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 18 Apr 2019 03:51:14 GMT
server
cloudflare
age
1967
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
52205e5fed508c86-VIE
expires
Tue, 08 Oct 2019 13:54:43 GMT
beacon
beacon.tru.am/
0
351 B
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:44 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
52205e605d14cbcc-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
rid
match.adsrvr.org/track/
109 B
537 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.237.210 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-48-237-210.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
f8974adce797a671b36df4cd609c76eaf7d09c1c34330afdf75e0c5f3834cb9d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Wed, 06 Nov 2019 13:54:44 GMT
ping
api.viglink.com/api/
266 B
946 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
30e6a91cdfc3de164d8be2d3ab96dfbbed50ffae0ba271161478748e2236dce0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
266
Expires
Thu, 01 Jan 1970 00:00:00 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1570456484064
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.168.38 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-248-168-38.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a74f45863d08ffe043bd57db4d0b836b72df249cc64b0e0c38346f8f318603a2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v045-035304d20.edge-irl1.demdex.com 5.59.0.20190904135845 2ms (+1ms)
Pragma
no-cache
Content-Encoding
gzip
X-TID
p/aGG885QL4=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
673
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
140 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1570456484064
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DC8) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (lha/8DC8)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Mon, 07 Oct 2019 14:04:44 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=84b0c8ef-41d0-4b8a-a999-2f800acf8635&assettitle=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&assettype=content_article&pubdate=2019-10-07%2013%3A00%3A00&viewguid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&devicetype=desktop&sitetype=responsive%20web&author=charlie%20osborne&authorid=79d67b90-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1570456484051&ld=www.zdnet.com&ldc=af4553ee-2aa8-47d8-b335-196620d95399&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=Zp7uuV2bQ6OxZaj2eTs&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&title=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=223
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 7620
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.105.8 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-105-8.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=28792544919415854063931073179838359024
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 03 Oct 2019 09:48:51 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=28792544919415854063931073179838359024;Path=/;Domain=.demdex.net;Expires=Sat, 04-Apr-2020 13:54:44 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
6bas6mJIRXQ=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/
90 B
595 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=28560213352085925183952595644052365448&ts=1570456484105
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-130-224.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
0e3d11c4ef66b313ce0bd93d94e3a2060d4d5668e801cf919d9c087ce9e57e61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-5b97fbbbd9-lsmc2
vary
Origin
x-c
master-1023.I23979f.M0-290
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-type
application/x-javascript
content-length
90
x-xss-protection
1; mode=block
/
5f651e6f.akstat.io/
0
354 B
XHR
General
Full URL
https://5f651e6f.akstat.io/?h.pg=article&when=1570456484114&t_other=custom4%7C240&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=ad583b0c4bd9b687cb77b68592040477f83b4e71&h.t=1570456483767&http.initiator=api&rt.start=api&rt.si=ad1fa921-41c7-4286-9905-d3731a317791&rt.ss=1570456484578&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Mon, 07 Oct 2019 13:54:44 GMT
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
9f1b16bfc6f448a348f20c4fc091c1dd4d5a4c3838af60cb01c49522e3df76e6

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=28560213352085925183952595644052365448&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ECDA1D27FFF8000-40117FFB4396DE59&ts=1570456484264
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.168.38 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-248-168-38.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
3f3437c0ee53d901590cb8b3526b726bcf713fded382662123e615f4159dee3a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v045-033e267e6.edge-irl1.demdex.com 5.59.0.20190904135845 4ms (+1ms)
Pragma
no-cache
Content-Encoding
gzip
X-TID
hfr8rClbQXs=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
674
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s2420845952678
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s2420845952678?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=7%2F9%2F2019%2015%3A54%3A44%201%20-120&d.&nsid=0&jsonv=1&.d&mid=28560213352085925183952595644052365448&aid=2ECDA1D27FFF8000-40117FFB4396DE59&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&cc=USD&ch=editorial&server=www.zdnet.com&v0=ftag%3ARSSbaffb68%7C&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=79d67b90-8175-11e2-9d12-0018fe8a00b0&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=84b0c8ef-41d0-4b8a-a999-2f800acf8635&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=Zp7uuV2bQ6OxZaj2eTs&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-130-224.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
53cee335f89ac901c2af71c49498a7bf00e3f9aba9729ad6cc30527f95bc952b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-aam-tid
UjJDSulaQ8A=
date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
x-c
master-1023.I23979f.M0-290
p3p
CP="This is not a P3P policy"
status
200
content-length
1597
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-v045-0621cfe27.edge-irl1.demdex.com 5.59.0.20190904135845 6ms (+1ms)
pragma
no-cache
last-modified
Tue, 08 Oct 2019 13:54:44 GMT
server
jag
xserver
anedge-5b97fbbbd9-c742s
etag
2ECDA1D205158000-40086943239E9825
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Sun, 06 Oct 2019 13:54:44 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=wyqLMcxc&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
8ea829bfead62289894848e67f3fbc2fb4249e1d496aca395d96c2c3a5778a6f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
X-Proxy-Origin
89.38.96.189; 89.38.96.189; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.6:80
AN-X-Request-Uuid
73f3df51-979d-4699-95a7-fe0c3e5a9eb3
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=GItC5z4F&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
39a9055cfbe499fba4cdc4212910871b3a49af7c0e1a3c047294aa9c18c1b66a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
X-Proxy-Origin
89.38.96.189; 89.38.96.189; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.250:80
AN-X-Request-Uuid
5b13fc24-cc82-44b8-b7ce-fc1182a571b9
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=75gKwbvL&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4cb8b95af340960b29e35ffdf555783853dadf7205e42174809aeeb0c38b6f66
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
X-Proxy-Origin
89.38.96.189; 89.38.96.189; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.250:80
AN-X-Request-Uuid
d8c6e9cd-6b15-4a02-8bdd-e7839704848e
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=INIH9QYG&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
412885350618a27cf29d952cf6edd470c828fab5005ce8f3d97b352a77e06299
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
X-Proxy-Origin
89.38.96.189; 89.38.96.189; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.143:80
AN-X-Request-Uuid
85506aa5-b217-4f33-ac00-26fa30e3d577
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=paP2NelV&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
aebed54dc4bcd651a6da674de19cf434be4f80d66cb6bdcf63507bdc47c06149
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
X-Proxy-Origin
89.38.96.189; 89.38.96.189; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.187:80
AN-X-Request-Uuid
5b2ebb82-415b-41c8-a643-b01cd02ae601
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/
66 B
943 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A75311543%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2264e20ea7-93b9-490e-bfd2-ceecb1845b90%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-10-07T13%3A54%3A44%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2405e15e218da3c25783b6f2206344bec4d54426fc734ddcf97ba9926edeb58

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Mon, 07 Oct 2019 13:54:44 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8DFD) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECAcc (lha/8DFD)
etag
"1112944691+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Tue, 22 Oct 2019 13:54:44 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
970 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D17) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:41 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8D17)
etag
"461771432"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Tue, 22 Oct 2019 13:54:41 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D8C) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (lha/8D8C)
etag
"4198895974"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Tue, 22 Oct 2019 13:54:44 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8CA5) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECAcc (lha/8CA5)
etag
"931235332"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Tue, 22 Oct 2019 13:54:44 GMT
utag.1810.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (lha/8D7F) /
Resource Hash
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
last-modified
Mon, 08 Jul 2019 17:22:10 GMT
server
ECAcc (lha/8D7F)
etag
"4274102907+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
988
expires
Tue, 22 Oct 2019 13:54:44 GMT
pixel_details.html
www.everestjs.net/static/ Frame F8EC
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Content-Encoding
gzip
Content-Length
146
Cache-Control
max-age=48966
Expires
Tue, 08 Oct 2019 03:30:50 GMT
Date
Mon, 07 Oct 2019 13:54:44 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Server
Apache
Set-Cookie
everest_session_v2=XZtDpAAABDfLrTry; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XZtDpAAABDfLrTry; path=/; domain=.everesttech.net; expires=Wed, 01-Sep-2021 00:34:44 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XZtDpAAABDfLrTry&gsurfer=XZtDpAAABDfLrTry&optout=0&throttleCookie=&time=20191007135444
Content-Length
345
Keep-Alive
timeout=15, max=991943
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Cookie set dest5.html
cbsi.demdex.net/ Frame D4C5
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.105.8 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-105-8.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=28792544919415854063931073179838359024; dextp=269-1-1570456484251|477-1-1570456484352
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 03 Oct 2019 09:50:27 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=28792544919415854063931073179838359024;Path=/;Domain=.demdex.net;Expires=Sat, 04-Apr-2020 13:54:44 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
LYHLs161RbA=
Content-Length
2764
Connection
keep-alive
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
60d67a916bedc4a537c42a443292a7cb19d05a6de88124020fb23d3ba94720fd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
494
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 07 Oct 2019 13:44:59 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:44 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
dbb2fbc9-99a9-4ecf-a1ac-335cb29c53fd
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Mon, 07 Oct 2019 15:14:59 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/
406 B
401 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
254573
status
200
vary
Accept-Encoding
content-length
270
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c451-196"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 11 Oct 2019 15:11:50 GMT
image-gallery-modal-e49526b449-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
20466
status
200
vary
Accept-Encoding
content-length
1909
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c451-13d0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 14 Oct 2019 08:13:37 GMT
screenshot-2019-06-10-at-14-27-52.png
zdnet3.cbsistatic.com/hub/i/r/2019/06/10/a608afcf-2b94-420e-a473-02c4c77b8ab3/thumbnail/170x128/aaaab70b423e13dbe3886229367df1b5/
25 KB
25 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/06/10/a608afcf-2b94-420e-a473-02c4c77b8ab3/thumbnail/170x128/aaaab70b423e13dbe3886229367df1b5/screenshot-2019-06-10-at-14-27-52.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5a582fb4d43f615b09690329cd3322b639866d85cf403cf4863bd1df5588ffee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6292974
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
25444
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"68f4f1c9069efc3169ccef543fc9b706"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-28-55.png
zdnet3.cbsistatic.com/hub/i/r/2019/06/10/e6efcc25-9e7e-47d5-9641-7a97c979d351/thumbnail/170x128/bb0fb254716d9f67e038aeff0706e5da/
48 KB
48 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/06/10/e6efcc25-9e7e-47d5-9641-7a97c979d351/thumbnail/170x128/bb0fb254716d9f67e038aeff0706e5da/screenshot-2019-06-10-at-14-28-55.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad094ec33835b32c304e47fb0b9e1698be7fd7c3909bd69c5a3476637c2d16ad
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6277579
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
49487
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"3d2a67b164177142ff0a63a068c4ed6d"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-29-38.png
zdnet4.cbsistatic.com/hub/i/r/2019/06/10/02930083-ac83-483b-bf21-568ed9f8f0fd/thumbnail/170x128/cf26fcd7430bfc75cfdef669fd1d73be/
18 KB
18 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/06/10/02930083-ac83-483b-bf21-568ed9f8f0fd/thumbnail/170x128/cf26fcd7430bfc75cfdef669fd1d73be/screenshot-2019-06-10-at-14-29-38.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad5896552117e82b7c344c695094d9fe6886891e229a213b669690d20917cb08
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6287198
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
18576
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"6e3ecad52139bb39a39d592e0b206b53"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-34-07.png
zdnet2.cbsistatic.com/hub/i/r/2019/06/10/a10ea56a-f051-499d-9f8f-ca3a7d2831e4/thumbnail/170x128/5d68d2914b1e7033537e49bb8296024a/
38 KB
38 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/06/10/a10ea56a-f051-499d-9f8f-ca3a7d2831e4/thumbnail/170x128/5d68d2914b1e7033537e49bb8296024a/screenshot-2019-06-10-at-14-34-07.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3598803978ce74966c652122fa1a6bff57db30f42052941f385fe0903aa12195
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3488441
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
38555
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"2551f901c615b9e8c58d169fc1a560db"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-06-10-at-14-31-05.png
zdnet1.cbsistatic.com/hub/i/r/2019/06/10/5028cb1a-a6d4-4bd6-adc6-b4b505aa7e31/thumbnail/170x128/c78bf59a74ce9f14a692bb9b107c8473/
30 KB
30 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/06/10/5028cb1a-a6d4-4bd6-adc6-b4b505aa7e31/thumbnail/170x128/c78bf59a74ce9f14a692bb9b107c8473/screenshot-2019-06-10-at-14-31-05.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3c2981033b716002ee84bebb7f9bef2549566d98221d55e47dc30a1a4f633643
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4796876
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
30943
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"23ca67cfd093157f2b1b68bafb1f0a3e"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
disqus-loader-db6fae9369-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
905 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
29601
status
200
vary
Accept-Encoding
content-length
642
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c451-580"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 14 Oct 2019 05:41:22 GMT
screenshot-2019-10-07-at-09-24-28.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/07/3600f8d1-6e56-4a94-9e1f-c0423c724a3d/thumbnail/70x53/c99503397d2f7951891885d4c61d9592/
10 KB
10 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/07/3600f8d1-6e56-4a94-9e1f-c0423c724a3d/thumbnail/70x53/c99503397d2f7951891885d4c61d9592/screenshot-2019-10-07-at-09-24-28.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5cc458e9d660cd459e46afabb10f499ad72e32e7ac5a786ac630de660f3279d7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
age
10845
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10594
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"86c68e91153da429d0930c9ad13d1311"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-07-at-09-23-25.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/70x53/86fd4655c4cc74b8299af2cbcb54049c/
10 KB
10 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/70x53/86fd4655c4cc74b8299af2cbcb54049c/screenshot-2019-10-07-at-09-23-25.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
198d338c5b5bad541dc19856972d15abf9d782fde423b460b4a7f89681c08d84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15997
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10446
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"129062814faa8bf423948596f415072b"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-03-at-09-41-19.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/70x53/f870159dd5a0421ac2b2a6f6e0cbe657/
9 KB
9 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/70x53/f870159dd5a0421ac2b2a6f6e0cbe657/screenshot-2019-10-03-at-09-41-19.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1a5c80dfd13ceaa7f3053ebd95d6fdcca75db8c30100bb8ae7ec04204e4436d9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
353449
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
9347
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"651468b37f95f5f421cccbf8fb7ee376"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-03-at-09-40-51.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/70x53/eeccb5bb95b4f66affaf538a46221ebe/
10 KB
10 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/70x53/eeccb5bb95b4f66affaf538a46221ebe/screenshot-2019-10-03-at-09-40-51.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1e799154a4de8bb8dc53bb9a5f06cdd0d38ee2ebb4c826c3b70914955d653127
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
356682
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10139
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"805b74daca86ea2e20ca9c166ee52f9e"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f9230bd65b34ae73f879ddcf528ed530df0fee0dca551e23966aba2f3f8cf354
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
726
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:44 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
445bb84a-c052-446b-bcf7-e50b93c02a33
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Mon, 07 Oct 2019 13:54:44 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
257708
status
200
vary
Accept-Encoding
content-length
1564
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c451-124a"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 11 Oct 2019 14:19:36 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
936 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
495701
status
200
vary
Accept-Encoding
content-length
827
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:04:57 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d936b19-514"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 20:13:02 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
143 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
age
456228
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:05:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d936b28-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 07:10:56 GMT
comscore.streaming.6.1.1.171219.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/
104 KB
19 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
age
635395
x-cache
HIT, HIT
status
200
content-length
18881
x-amz-id-2
neN7zmXGABIZIsD8sbebZF9DlZwNnRoW8FayLQeAr6iI61AA4xefpinkv4fSD61J73FNfhwdnmU=
x-served-by
cache-dca17772-DCA, cache-hhn4046-HHN
last-modified
Fri, 01 Feb 2019 18:21:03 GMT
server
AmazonS3
x-timer
S1570456485.560405,VS0,VE0
etag
"c3c30c0ebfc35a9426296256fc3133d8"
vary
Accept-Encoding
x-amz-request-id
2141EBE8710B207D
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
173, 7
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Thu, 10 Oct 2019 13:54:44 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570456484578&ns_c=UTF-8&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c9=
Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570456484579&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.214.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-18-214-98.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:44 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:44 GMT
server
nginx
status
302
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570456484579&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
121 KB
32 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31604
x-xss-protection
0
pragma
public
x-fb-debug
maknPN9hHu8AIXWF+unoCgwOoVkWPEmu0q4qJEopxg9ooZJu7b/xFiuzxI1ABRf+7qelloOHMorXccEyMtYbCg==
x-fb-trip-id
1475214379
x-frame-options
DENY
date
Mon, 07 Oct 2019 13:54:44 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
60 KB
15 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
6c849673497b1b5c33c9a09e812aa0da912bc3564c30c1585ae151aa995e4e76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
224350
cf-polished
origSize=62065
status
200
edge-control
max-age=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"f271-BkBPGSSER0aT3YysQanZWmWgsOA"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=60, s-maxage=604800
cf-ray
52205e64f9219c57-AMS
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cbs_zQTp2H_zdnet.js
cdn-magiclinks.trackonomics.net/client/static/v2/
95 KB
18 KB
Script
General
Full URL
https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20ac:8800:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 01:21:56 GMT
content-encoding
gzip
last-modified
Wed, 21 Aug 2019 10:15:58 GMT
server
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age
30782
status
200
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
access-control-allow-origin
*
x-amz-cf-pop
PRG50
x-amz-cf-id
33ERRkhYEk-SYVqT41olZdNPjlqkMIyjuWqj9SjjmmAxOoewhd33eQ==
via
1.1 2e39ee11d8fef0dbede5fe684e3ef0a0.cloudfront.net (CloudFront)
screenshot-2019-10-03-at-09-40-51.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/70x53/eeccb5bb95b4f66affaf538a46221ebe/
10 KB
10 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/70x53/eeccb5bb95b4f66affaf538a46221ebe/screenshot-2019-10-03-at-09-40-51.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1e799154a4de8bb8dc53bb9a5f06cdd0d38ee2ebb4c826c3b70914955d653127
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
356682
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10139
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"805b74daca86ea2e20ca9c166ee52f9e"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-07-at-09-23-25.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/70x53/86fd4655c4cc74b8299af2cbcb54049c/
10 KB
10 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/07/42c41882-d6bc-4963-80ff-ca38e2618b35/thumbnail/70x53/86fd4655c4cc74b8299af2cbcb54049c/screenshot-2019-10-07-at-09-23-25.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
198d338c5b5bad541dc19856972d15abf9d782fde423b460b4a7f89681c08d84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15997
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10446
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"129062814faa8bf423948596f415072b"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ima3.js
s0.2mdn.net/instream/html5/
270 KB
92 KB
Script
General
Full URL
https://s0.2mdn.net/instream/html5/ima3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
58c3a8b84bba035bda0914930d98472b686ac3c94a8dd3fda83cd261619dc89d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
93812
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:44 GMT
feature-disabled-d41d8cd98f-rev.js
zdnet3.cbsistatic.com/fly/js/
0
281 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/feature-disabled-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
age
503040
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:04:58 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d936b1a-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 18:10:43 GMT
screenshot-2019-10-07-at-09-24-28.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/07/3600f8d1-6e56-4a94-9e1f-c0423c724a3d/thumbnail/70x53/c99503397d2f7951891885d4c61d9592/
10 KB
10 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/07/3600f8d1-6e56-4a94-9e1f-c0423c724a3d/thumbnail/70x53/c99503397d2f7951891885d4c61d9592/screenshot-2019-10-07-at-09-24-28.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5cc458e9d660cd459e46afabb10f499ad72e32e7ac5a786ac630de660f3279d7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
age
10845
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10594
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"86c68e91153da429d0930c9ad13d1311"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-10-03-at-09-41-19.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/70x53/f870159dd5a0421ac2b2a6f6e0cbe657/
9 KB
9 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/70x53/f870159dd5a0421ac2b2a6f6e0cbe657/screenshot-2019-10-03-at-09-41-19.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1a5c80dfd13ceaa7f3053ebd95d6fdcca75db8c30100bb8ae7ec04204e4436d9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
353449
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
9347
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"651468b37f95f5f421cccbf8fb7ee376"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/
882 B
590 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27154
status
200
vary
Accept-Encoding
content-length
460
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c451-372"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 14 Oct 2019 06:22:10 GMT
4083-12969.js
www.everestjs.net/dl/4083/
484 B
664 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21983
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Mon, 07 Oct 2019 20:01:07 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c38d7-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=991930
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFp0RHBBQUFCRGZMclRyeQ
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEFmvqS3OMFHGPJ-ENu0lsXQ&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=999496
Content-Length
128

Redirect headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
ads
securepubads.g.doubleclick.net/gampad/
107 KB
13 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=742446501471087&correlator=4443947323511723&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&eid=21062421%2C21062452%2C21063635%2C21064170%2C21064368%2C21064521&vrg=2019093001&guci=2.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191007&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=64&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%26env%3Dprod%26firstpg%3D1%26vguid%3Db7c7dd3f-6c92-4cae-9d07-4956dea78fec%26session%3Df%26subses%3D6%26ftag%3DRSSbaffb68%257C&cookie_enabled=1&bc=31&abxe=1&lmt=1570455909&dt=1570456484650&dlt=1570456483000&idt=523&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=3155306648%2C4282717970%2C298201341%2C3842789156%2C844366853%2C1824408606%2C3163203411%2C976381719&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&dssz=87&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x3746%7C1585x0%7C1585x0%7C370x0%7C370x0%7C370x250%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C300x280%7C300x280%7C728x130%7C371x771&ga_vid=303970339.1570456485&ga_sid=1570456485&ga_hid=722491965&fws=132%2C4%2C132%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
4d69c4f77d97653abc3b3ee46d3733e482966ee4d886711decf35a375fa22630
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13197
x-xss-protection
0
google-lineitem-id
4745974454,-2,130393329,4745571990,4745571990,4745571990,4745696286,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239360957,-2,43324823049,138248164876,138248164645,138239321475,138239338545,138247024569
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019093001.js
securepubads.g.doubleclick.net/gpt/
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
25ee8438325f726833afbcc7f75f152d9640156bda461c1b4636275af51c5dbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Sep 2019 13:06:17 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24646
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:44 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/
2 KB
796 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
359214
status
200
vary
Accept-Encoding
content-length
710
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c451-7a5"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 10 Oct 2019 10:07:50 GMT
309391486091569
connect.facebook.net/signals/config/
307 KB
78 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.9.4&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
79752
x-xss-protection
0
pragma
public
x-fb-debug
BR84fjsmitBUPuDqdO0TvJqA3CKKmpmEP23y/XexIKjbVJQeafhRRueL+UdwCA9ewSWqgU/EqENktX9qNTwIiQ==
x-fb-trip-id
1475214379
x-frame-options
DENY
date
Mon, 07 Oct 2019 13:54:44 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
z
lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/
332 B
580 B
Script
General
Full URL
https://lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1570456484756&callback=jQuery171043415887113668616_1570456483659&_=1570456484757
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
a7ef48cdd97935f47145d6b7a80a3ac8ddd2e7b73971a419a8efd5d0a550d468

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Content-Length
367
Vary
Accept-Encoding
Content-Type
application/javascript
z.gif
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO...
183 B
578 B
XHR
General
Full URL
https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:50a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba

Request headers

Accept
*/*
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
br
cf-cache-status
HIT
age
74948
x-powered-by
ASP.NET
status
200
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
access-control-allow-credentials
true
cf-ray
52205e65fc935994-VIE
expires
Tue, 08 Oct 2019 13:54:44 GMT
headerstats
as-sec.casalemedia.com/
0
337 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Mon, 07 Oct 2019 13:54:44 GMT
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
151.208.227.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:30 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1556302399
age
14
x-guploader-uploadid
AEnB2UoBHM1Qphflg-qDF62mBbdnD4Z46lAoIGhYPb1dj1axP0XVR0IN8v-KX1IwTzCPyGfdRNcEHi1XyMLek754dR9wZFI_9rHm4dkBvLCQJlPk5TtnbYI
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16960
last-modified
Fri, 26 Apr 2019 18:13:21 GMT
server
UploadServer
etag
"251defdc0ecc8a3bad8ae4cf9aab1923"
vary
Accept-Encoding
x-goog-hash
crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation
1556302401249893
cache-control
public, max-age=300
x-goog-stored-content-length
16960
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 07 Oct 2019 13:59:30 GMT
VideoHeartbeat-2.0.2.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
143 KB
29 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
age
1428178
x-cache
HIT, HIT
status
200
content-length
28977
x-amz-id-2
+2U9dXma+eMS0pCyjOsjSQxM2XeIVTtFChnnV0tNV/KxKbDrO0L+Wu3OXPxKg3U2iN4g4fPtx3Y=
x-served-by
cache-dca17740-DCA, cache-hhn4046-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1570456485.806701,VS0,VE0
etag
"215943f0e77b4fcc9cc72b98a8ea1cfc"
vary
Accept-Encoding
x-amz-request-id
B56B3145A1D646B8
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
162, 104
inferredEvents.js
connect.facebook.net/signals/plugins/
35 KB
10 KB
Script
General
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
10218
x-xss-protection
0
pragma
public
x-fb-debug
VuC6WxmYXDDtxFoJtscqy6WqeZAMV5VZI77KJod64WGjMlglMbgJEXD9XNQRzh6ewqKQgwbxIoxaCkF1HmXVIg==
x-fb-trip-id
1475214379
x-frame-options
DENY
date
Mon, 07 Oct 2019 13:54:44 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=pEObXaS_MpD1gA...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351&ipr=y
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:44 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=634025933&crd=&is_vtc=1&random=1005835351&ipr=y
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
341 B
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::a000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"1433c2-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=993955
Content-Length
128
count.js
zdnet-1.disqus.com/
1 KB
1 KB
Script
General
Full URL
https://zdnet-1.disqus.com/count.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
2496034
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 04 Sep 2019 20:05:34 GMT
Server
nginx
ETag
"5d70190e-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1570456484823&s=03b488cdb985577d1f0f2fbe0f5419ff18e48ab92eee1be1743741c97df27818
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
41c195d9dc014931ef4c8baac01679b67e3e3b6f58508df9541b72528a1329e0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
736
/
www.facebook.com/tr/
44 B
323 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&rl=&if=false&ts=1570456484829&sw=1600&sh=1200&v=2.9.4&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1570456484828.1277789759&it=1570456484742&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 07 Oct 2019 13:54:44 GMT
AppMeasurement-2.3.0.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
77 KB
27 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
age
3468995
x-cache
HIT, HIT
status
200
content-length
27260
x-amz-id-2
kLgdw2sQfzW8EBCh5gIdAjguNFSLxkDKLDKkIhVUuGHzfy43GfeyKZQFej1nTwA00aYX5B/mtiI=
x-served-by
cache-dca17775-DCA, cache-hhn4046-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1570456485.843816,VS0,VE0
etag
"d71ba6c9a930b6864408830c3e2705f9"
vary
Accept-Encoding
x-amz-request-id
C7320C852C9DB622
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
16, 122
/
0211c814.akstat.io/
0
354 B
Other
General
Full URL
https://0211c814.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:44 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Mon, 07 Oct 2019 13:54:44 GMT
ggcmb510.js
cdn-gl.imrworldwide.com/novms/js/2/
12 KB
5 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:b800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
7mioloFf72U0Qkc4Taa4MD_zEyvZEgsP
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 15:40:32 GMT
server
AmazonS3
age
1083
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Mon, 07 Oct 2019 13:54:12 GMT
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
BJp_8k_Enc71Vxbvea467J5blVp1Gvqjh4pmcH6-Ko_rh4KK4a3ZJw==
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
bcn
www.summerhamster.com/
43 B
181 B
Image
General
Full URL
https://www.summerhamster.com/bcn?fe=1570456484863&y=2.0.1105&elg=280366055&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Frog-guxsdojhggrq2-ufh-lv-vwloo-ehlqj-hpsorbhg-lq-fbehufulplqdo-dwwdfnv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fwltvikxq%2Fvvtnywqsphj%2Fxarxul%2F%3Brug%3D1570456483309%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.160.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-157-160-140.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 07 Oct 2019 13:54:44 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
mux.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/
81 KB
25 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
content-encoding
gzip
age
1062532
x-cache
HIT, HIT
status
200
content-length
25193
x-amz-id-2
TGcpi0DTUixP906ah+mUc5NccBcsisIooRo5Bctp8JdEs70Aa2+LP6DbaRc35WRNcZSF0h29Qqw=
x-served-by
cache-dca17731-DCA, cache-hhn4046-HHN
last-modified
Fri, 01 Feb 2019 18:21:06 GMT
server
AmazonS3
x-timer
S1570456485.895833,VS0,VE0
etag
"5d69e0e991739e9cd3f544944c8b3739"
vary
Accept-Encoding
x-amz-request-id
22D38B7EB978846A
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
169, 104
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
uvp_blank.mp4
vidtech.cbsinteractive.com/h5/blanks/
11 KB
11 KB
Media
General
Full URL
https://vidtech.cbsinteractive.com/h5/blanks/uvp_blank.mp4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

date
Mon, 07 Oct 2019 13:54:44 GMT
via
1.1 varnish, 1.1 varnish
age
3392904
x-cache
HIT, HIT
status
206
x-cache-hits
558763, 173736
Content-Length
11247
x-amz-id-2
RWSuYoveoPlVL8+CKVrvoJOxvT/jZR2ccK055Pg68MOkg2YkaejHy+1cH72KSfRTxtYrLSmSGpM=
x-served-by
cache-dca17731-DCA, cache-hhn4046-HHN
Content-Range
bytes 0-11246/11247
last-modified
Fri, 21 Dec 2018 00:54:05 GMT
server
AmazonS3
x-timer
S1570456485.943516,VS0,VE0
etag
"707bb2a4c9141aba1068d851f5be0409"
x-amz-request-id
4F6B1AEF2D270DCA
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
video/mp4
x-amz-meta-mtime
1296432000
glcfg510.js
cdn-gl.imrworldwide.com/novms/js/2/configs/
2 KB
1 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:b800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
.dtx57my2OREzULNOzccgPn4wUjEtWqi
content-encoding
gzip
last-modified
Mon, 12 Aug 2019 17:38:40 GMT
server
AmazonS3
age
3877
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Mon, 07 Oct 2019 13:17:12 GMT
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Ymb_gqwddmkeKL1H1CNSlsN-qM7jlzqTLb_O_lZLgM3HSJ4m3Y_8eg==
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=28560213352085925183952595644052365448&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ECDA1D27FFF8000-40117FFB4396DE59&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1570456484975
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.168.38 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-248-168-38.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bc9560f50ec598538093147af28945c6117bf0b46e1571636f7e7c57ff2d5d79

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v045-057bcc830.edge-irl1.demdex.com 5.59.0.20190904135845 4ms (+1ms)
Pragma
no-cache
Content-Encoding
gzip
X-Error
300,300
X-TID
5UI+j3sFREc=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
675
Expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://www.zdnet.com

Response headers

Content-Type
application/font-woff;charset=utf-8
view
securepubads.g.doubleclick.net/pcs/ Frame 6951
0
75 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssonCZu61qP2hsAD0WUyzki8J9rOsVTsQ6TBpcE7Xv6-nbux3tzjZlFGtqrDUhS0xxfAgWJqXMOel72qei5lCHx4dnbE5EODk_Xwfn7BM6HfIzvaxwwD1-YFY-wYxTOdPnYcvJKtFH61z7UDwzrKsAUOUa9zpmVz3Ks6X2ZDlpo_0pfTPfa11Hi58hJwtpqzJUMx63Lo4YZSbk461ySaAWdYxdfZ5ymGleVCZDBbhTQutN6kPFthMoUbae9r7-1cCn1Uw&sig=Cg0ArKJSzMwUMaAL3JnSEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 6951
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 6951
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
03cdd154a67240548616e679dde7dd00a53bbfb48697a1635bafef7fd09406c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29127
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2C98
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscewetlX_ESzab3H8j4VEx6i1TwBOC6hQhkKKrmrhEnhz8i_P6objBFnBROuYzApxNX7XfRFCysWf5--lYQIgeBa0w7K-6mC5WJefRl_19EFbbsTTp2zYr9qkkcwzpV3QfetqD8DyhXUC_2LvW3KI2d87uSznOYHrf9R2EGdAjdmf40Mb3Vor6ZS680V043O6cITVk2ToSHm-VyPltEbutwA_hMfx9ydezBpuhwNV90BiK2-3dTTseUyWtuOaFPMDZ&sig=Cg0ArKJSzA4fQbSjcn-VEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2C98
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2C98
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 69CE
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvXFbs5Xwr0t7b_MohcehQOUbKSwWU1QM7nFXZ8fJCT80kGyXh8_6zVQ87EYjFH9nfozNFJJSjyh5ogs9nFnyCz1GfU4NnqjU0Q3VHRQpGVVccV8p00kCVz5Z0I-Pt6pJ-vt2JHRhEfhRm7buKgtSr0iy3SeFZzs8l3wQ8zr6aiOaghEUaC_Y4eCoP2HPXVnz_sfb1of0Q8PNsDu2UFDpuu7wjGFk4hAowYHo6ifOisR-kscg2sSn00QS_xxZk2yDcj2g&sig=Cg0ArKJSzNonlOqlUWPLEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 69CE
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 69CE
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 2515
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfcd1nniUN7WC8LIfaUQfEM2rjmQ_OYtO_Rxlgto5pVYUPAUS6sD37XR_ga41YA8JmmAf-5HgntylON7xN52IXNS9jnU5te41SLSAprVd-Wgecp6mv2yFN2p8vwmaQnjl_VDbAVWeRDtD2oafgdtL4ioAgOht6_qc-_w5PUEvkcJFlGmOChyahCTOHZqehZ1TRrhFvOUIj-knKkfen4KOmE8N7ijbYrZ4pENlIX8raTFd7Z_2Iy7pAr4jsWqzpAlXXYA&sig=Cg0ArKJSzNacnIMhmvROEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2515
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2515
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
bridge3.338.1_en.html
imasdk.googleapis.com/js/core/ Frame EA6D
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.338.1_en.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.338.1_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
193084
date
Fri, 04 Oct 2019 18:26:19 GMT
expires
Sat, 03 Oct 2020 18:26:19 GMT
last-modified
Fri, 04 Oct 2019 18:22:29 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
242906
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
/
www.zdnet.com/video/related-videos-xhr/cybersecurity-clicking-email-links-could-put-your-data-at-risk/
34 KB
6 KB
XHR
General
Full URL
https://www.zdnet.com/video/related-videos-xhr/cybersecurity-clicking-email-links-could-put-your-data-at-risk/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
cf759eb04f32815b2282dc5f89f818ed32c094760d82b4aebbd980e4c475aedf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
last-modified
Mon, 07 Oct 2019 13:21:31 GMT
vary
Accept-Encoding, User-Agent
content-length
5426
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
x-newrelic-app-data
PxQCVVZaCAcTVVJaAQIAUVAAFB9AMQYAZBBZDEtZV0ZaClc9HiBQFg1ZWT1JEV1fURAEBmhHXgIBXkVsGg4RQBxSFlIICAQCH1UXUglZAFVIGwZNRAZZBgNVUVMGVAEFUgAEBlNETwRRDksHZQ==
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:45 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
2f9c6bd0-f7b1-4724-ae10-001a5053c8db
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Mon, 07 Oct 2019 14:51:31 GMT
36A8CE_2_0.woff2
vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/
53 KB
54 KB
Font
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/36A8CE_2_0.woff2
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
via
1.1 varnish, 1.1 varnish
age
2220009
x-cache
HIT, HIT
status
200
content-length
54767
x-amz-id-2
MB4kz71c4pCgKqmbxlPCRwopnXgRkM+K6PNPBZydd9jschWqEK3QWyQXFkKNxNrVPNecOxrwKKc=
x-served-by
cache-dca17720-DCA, cache-hhn4038-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1570456485.148528,VS0,VE0
etag
"22d779c809ed11e380d62c76e1f202e8"
access-control-max-age
3600
x-amz-request-id
3ADB3AE2E6D210C6
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
157, 85
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fcybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8&i=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&g0=security&g1=charlie%20osborne&u=BSLGUkDIQT23C_1TE1&t=Qb7EbmBNPPWA8IPDK2Xu_W6tJR&x=0&y=0&V=116&VS=VS&n=1&b=1627&r=&_vd=69000&_vi=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&_vh=zdnet.com&_pu=CWJvBpBbICeECR3Ifi&_pt=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0&W=0&R=0&I=1&E=0&j=75&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:45 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame 5B7C
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstjTT507j4bDPACVJ8YwraH1EV8kTjpM7dx4TUqELViXhtwbPiyNsU3pKejV5b2pcGNS3KSOoQXGFUdfMTo201y8WMRlXXjgs3x7QAi6sbZEsrkV9yYSQGZXCT4kRbszG72xpLKSMIgBhzzGvyfg4y_68UhcZ_a6RPFKXwi_dJyexfTFnV0d0K2YOhvNypCkCt86VXxQunAceSVqBZ3TYstFvDBunS6A-cPbq0mJAwAqB2ED8uhf8HJ1y_LjjsZXFPPYQ&sig=Cg0ArKJSzOK9yW-ZZWBOEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 5B7C
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 5B7C
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame ADA3
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu2Q1c_SMI7KqXxB8D3AiNiq-GHavScaoKn6_9xC9wyNl40IW3PdTh8xp3U_AZiArTxcDh0wWNV47WHpqvVzchr7Yz6xHTWTeAAfNn5Wft1575nNA_8-j93Ju9gr-KBuK4IknCT9oNLzZOCD8nniW3G35STWeZLW6g2x1xJPI0sOoTAAYHWtn3BGEanoqorqkkGDZasa_Rvgum01qpPEieGF_cBugf3UtagUCpfH_c1k6n1cOhZ4BKSLe2cjmVVHP0Hvw&sig=Cg0ArKJSzCdFiK_U4_BDEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame ADA3
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame ADA3
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 7E4F
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJOuQpHpM217ei5cAbYPX0J9BYzAbr7WViNmvrNL_nM_OT4J3Cjyu4ZSjMRhkck9MLAKjRhqj0lV5Rq9UBdGe58FoJHylVL2HOAYUnIX71LLVfCpb0kq_Gdb-xHYqWdr_JR8YhC4NwYpcfe4jn1q5_oZDMSEoTHdXohUq2vBjvIL7rcVp06Y-5_cd6jIJI92JcFs_nmuZEGSRacdG_mSEfjsvr5ARQJyGt468BNYX2QIYvojeKMoUIjZqvT0xtZwY48g&sig=Cg0ArKJSzETFjftrxK9LEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
adKit.min.js
rev.cbsi.com/common/js/ Frame 7E4F
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?1082662404
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
last-modified
Mon, 13 May 2019 18:29:20 GMT
server
Apache
etag
"e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
accept-ranges
bytes
content-length
2149
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 7E4F
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 7E4F
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
cdn-gl.imrworldwide.com/conf/
41 KB
8 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:b800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
h6vUD0w3qBUsDiAOZIJHl73TXD82poNU
content-encoding
gzip
last-modified
Tue, 01 Oct 2019 04:36:23 GMT
server
AmazonS3
age
3571
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400,s-maxage=86400
date
Mon, 07 Oct 2019 12:55:15 GMT
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
U7dOb7iFbVqO3CvLf7doQtiDHk4aQvGhpAvF3glCblkjyojVbPSM7A==
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
n.js
geo.moatads.com/ Frame 6951
105 B
279 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485288&de=978205090497&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=2&cb=0&ym=0&cu=1570456485288&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=344209368&cs=0&callback=MoatSuperV26.gna14650
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
4b86140ebb1d1068c0451bcb05c80e8cbf9d3b184c666b2aece15ccd2ec4f837

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"c4f896a0dc5fa1cba02036e8cf3141cd187594a8"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
105
n.js
geo.moatads.com/
105 B
279 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485288&de=978205090497&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=3&cb=0&ym=0&cu=1570456485288&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=553350633&cs=0&callback=MoatDataJsonpRequest
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
809550c41585719adc4daedc11821c2645c63eedc50bad95cdfdb4232e2bd9d2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"a97db4598a61ea1b7a7de93cc247b1591009b490"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
105
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485288&de=978205090497&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=4&cb=0&ym=0&cu=1570456485288&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1450743207&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
n.js
geo.moatads.com/ Frame 2C98
107 B
281 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485344&de=590822819744&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=7&cb=0&ym=0&cu=1570456485344&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=29319009%3A147075009%3A130393329%3A43324823049&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=728&zMoatH=90&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1518070620&cs=0&callback=MoatSuperV26.gna218006
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
93a1447e89af8b2c29a6344f2001e62601c8d168dd9f9996ea1bb06dc21dc68f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"9e8403c870ced3bc7fcacd57667840531a612412"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
107
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/
159 KB
46 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:b800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
LsknotgJ27sHWfh0olFMGPF0aUHXxFfq
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 15:40:32 GMT
server
AmazonS3
age
4804
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Mon, 07 Oct 2019 12:57:33 GMT
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
gag0jn_VH9lLNl2tcPkOppqgCiWiFXMSw_bvU6GyYYfKz3WFTErmuA==
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
n.js
geo.moatads.com/ Frame 2515
106 B
280 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485354&de=630569132876&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=12&cb=0&ym=0&cu=1570456485354&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138248164645&zMoatPS=middle&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1600882439&cs=0&callback=MoatSuperV26.gna57293
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
6d9c615cc0d9cb5db9b9abb42c4ec16521c9eb2911606cde4874402cf23882a0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"f833386d97f057421fe42f18bf31603dac3f6226"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
106
n.js
geo.moatads.com/ Frame 69CE
106 B
279 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485364&de=415996258908&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=17&cb=0&ym=0&cu=1570456485364&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138248164876&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1272694728&cs=0&callback=MoatSuperV26.gna495991
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
f8a7213020a4ec189f97f16583e6395ed0db2d48e1637f0f9862125c87f03808

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"16c090c10b401463ac5666a85c128eab1a96283c"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
106
how-sneaky-emails-scammers-make-cash-fro-5d971e64800f320001e3921e-1-oct-07-2019-11-08-18-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/07/f3af5763-7c40-49c5-9ab3-4c349444d677/thumbnail/170x96/bf7ba6fe1c63e593840671474ac9d6a6/
3 KB
3 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/07/f3af5763-7c40-49c5-9ab3-4c349444d677/thumbnail/170x96/bf7ba6fe1c63e593840671474ac9d6a6/how-sneaky-emails-scammers-make-cash-fro-5d971e64800f320001e3921e-1-oct-07-2019-11-08-18-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
189bba7ba537adda81f5b419eb9233ee29da6cb4481711bfc6876be76f045f75
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7805
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
2856
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"e2c61965b5e23b47b77d7c51611b6d7f"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
no-right-to-be-forgotten-heres-how-to-re-5d8c8834800f320001e01ff1-1-oct-02-2019-22-03-34-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/02/6a8f033c-c552-4c02-a878-a0d77e330319/thumbnail/170x96/282912150d588bafd753eacb55a879fc/
2 KB
3 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/02/6a8f033c-c552-4c02-a878-a0d77e330319/thumbnail/170x96/282912150d588bafd753eacb55a879fc/no-right-to-be-forgotten-heres-how-to-re-5d8c8834800f320001e01ff1-1-oct-02-2019-22-03-34-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
82d47a81e00e5a95607e27b7f3ec3ecff0c3c5e3eb159f80b122ac3770c8ac5b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
261244
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
2496
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c5dc3e08849bec07e33ca353de62ea04"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
microsoft-hewlett-foundation-and-masterc-5d9192f09fad230001c97c93-1-sep-30-2019-6-26-36-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/30/c9fbe316-d849-49dc-ab29-edddc0301eed/thumbnail/170x96/ecb1086078f81a1573db1d5099129592/
5 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/30/c9fbe316-d849-49dc-ab29-edddc0301eed/thumbnail/170x96/ecb1086078f81a1573db1d5099129592/microsoft-hewlett-foundation-and-masterc-5d9192f09fad230001c97c93-1-sep-30-2019-6-26-36-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0dec78b646458d7cb516d8b16a6b00d0b42e6585e9bd23d9a1e4f9d8aa0efbe8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
287639
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4883
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"d5036c64412973d610202be8dce2b82a"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
socasaservice-launched-by-macquarie-gove-5d8d820e9fad230001c8c2c6-1-sep-30-2019-24-21-16-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/30/9ccddf65-78a5-4fe3-986c-ce383b51943d/thumbnail/170x96/d16dae7cc786d1530b57dd0c8e04b999/
6 KB
6 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/30/9ccddf65-78a5-4fe3-986c-ce383b51943d/thumbnail/170x96/d16dae7cc786d1530b57dd0c8e04b999/socasaservice-launched-by-macquarie-gove-5d8d820e9fad230001c8c2c6-1-sep-30-2019-24-21-16-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5745383487c3952eea3e1897ef015b91ccd0b30b7400770b5c9000a9000225f9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
388402
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5801
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a9e18cb5dd9d3ab420946fa19ebbbf52"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
20191001-danny-karen-gdpr.png
zdnet2.cbsistatic.com/hub/i/r/2019/10/01/493c009c-f3a3-466d-a533-0296a7f69ae8/thumbnail/170x96/c43faa5b93fea1cc200cacd2d70a2fe2/
37 KB
37 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/01/493c009c-f3a3-466d-a533-0296a7f69ae8/thumbnail/170x96/c43faa5b93fea1cc200cacd2d70a2fe2/20191001-danny-karen-gdpr.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b5bd040e94c4a87a1efe3d50ad481d5409fcf52d351fc070577299f2b9132d6b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
499588
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
37502
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f24f96d246285d951fe203d06473ff09"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
hackers-target-transportation-and-shippi-5d8dc365800f320001e09d98-1-sep-29-2019-20-21-41-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/29/905fc4ea-408b-474f-a83d-e41e8dfea70b/thumbnail/170x96/b59051fe42de5cf5e98cd582a2ef896e/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/29/905fc4ea-408b-474f-a83d-e41e8dfea70b/thumbnail/170x96/b59051fe42de5cf5e98cd582a2ef896e/hackers-target-transportation-and-shippi-5d8dc365800f320001e09d98-1-sep-29-2019-20-21-41-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1996fb8b37fe4cf668c07fcdf89eedf167a0467acadbd5d177c078585232c745
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
591837
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4443
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"d03a857a23b5285736c4d55e0bb067c8"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
gdpr-heres-why-firms-are-still-strugglin-5d8dd0e2800f320001e0a64e-1-sep-27-2019-11-41-48-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/27/8e729479-7e27-4a2e-ad8c-6560e6f709cc/thumbnail/170x96/a6ff2f3cceeee1543e5d9a0d850e0c00/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/27/8e729479-7e27-4a2e-ad8c-6560e6f709cc/thumbnail/170x96/a6ff2f3cceeee1543e5d9a0d850e0c00/gdpr-heres-why-firms-are-still-strugglin-5d8dd0e2800f320001e0a64e-1-sep-27-2019-11-41-48-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3c8c5266002e44c9001cf7a9dff6ae0957769e7b45122b4abe63f9311c90de9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
600112
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4074
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"d2a2c1da2acde3ed27003dba9c3c1ccc"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
the-ultimate-guide-to-finding-and-killin-5d866a039fad230001c65fb5-1-sep-25-2019-17-05-22-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/25/e7d01642-2849-4784-b4e3-55b0b75b20c5/thumbnail/170x96/79fffa57e44d19c03b59ca167c082683/
4 KB
4 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/09/25/e7d01642-2849-4784-b4e3-55b0b75b20c5/thumbnail/170x96/79fffa57e44d19c03b59ca167c082683/the-ultimate-guide-to-finding-and-killin-5d866a039fad230001c65fb5-1-sep-25-2019-17-05-22-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a0846357a84bde9d83f32eff7da4622cda6456ff21ae9900628da7b9fafd398d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
867231
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4503
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"8620005ac78d8257435d490058c643dd"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-new-attack-has-links-to-gandc-5d8c8a98800f320001e021d1-1-sep-27-2019-11-44-25-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/27/a42bd1a3-af6b-44f6-8bf8-9cc634acdab2/thumbnail/170x96/06724dcff56e7c2e162fde142e685152/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/27/a42bd1a3-af6b-44f6-8bf8-9cc634acdab2/thumbnail/170x96/06724dcff56e7c2e162fde142e685152/ransomware-new-attack-has-links-to-gandc-5d8c8a98800f320001e021d1-1-sep-27-2019-11-44-25-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
585e68b616dc09fd14c7306595146b58e4f7178bd6d9397ccdb06035dcc90e6c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
870920
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
3586
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"6a450490f238b4ddff085d66a916a206"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
act-government-and-austcyber-launch-canb-5d88447d9fad230001c688b2-1-sep-23-2019-6-59-00-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/23/bf69e6e4-734b-4a15-8a4f-644ab89ce9b7/thumbnail/170x96/2a786f9c597a4f7b9a1298ad69ce23a6/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/09/23/bf69e6e4-734b-4a15-8a4f-644ab89ce9b7/thumbnail/170x96/2a786f9c597a4f7b9a1298ad69ce23a6/act-government-and-austcyber-launch-canb-5d88447d9fad230001c688b2-1-sep-23-2019-6-59-00-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3e7a5752fbc5eb7571f53132a305024cab6825bfaed3677a70c906b1ac47feb9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
893225
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4858
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a68259547f3d25ab3c0a5c0adb4e3498"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.facebook.com/tr/ Frame CCA5
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
6801
pragma
no-cache
cache-control
no-cache
origin
https://www.zdnet.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
cookie
fr=0XWCLgQ7swR0KP7IV..Bdm0Ok...1.0.Bdm0Ok.
Origin
https://www.zdnet.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-length
0
server
proxygen-bolt
date
Mon, 07 Oct 2019 13:54:45 GMT
carousel-f3b9253e16-rev.js
zdnet2.cbsistatic.com/fly/js/components/
312 B
363 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/carousel-f3b9253e16-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
254563
status
200
vary
Accept-Encoding
content-length
215
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:52 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c450-138"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 11 Oct 2019 15:12:00 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 7E4F
44 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1082662404
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
30da75fa42a0370a9eb050b016345bb9b1e0cd5d6c5047b7ac7f8fabb3bf86c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"301 / 360 of 1000 / last-modified: 1570118860"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14356
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
n.js
geo.moatads.com/ Frame 5B7C
106 B
280 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485410&de=431080844988&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=22&cb=0&ym=0&cu=1570456485410&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138239321475&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1082568195&cs=0&callback=MoatSuperV26.gna311135
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
ec1101c6e14f7ded25b801aec3d1ee0ecb5515c7e2513e62a7d26afbd554834b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"a66177c9aaa50e572a9215f2791361900e6b6e97"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
106
n.js
geo.moatads.com/ Frame ADA3
107 B
281 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485421&de=239679674849&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=27&cb=0&ym=0&cu=1570456485421&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745696286%3A138239338545&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=970&zMoatH=66&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=970x66&zMoatSZPS=970x66%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=277182159&cs=0&callback=MoatSuperV26.gna547057
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
b98444965eb1324a4a140b4c67e8e633631b6eb9edac5dd38387a82e454352c5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"fd156c74c778d612bd10a8a188ea955002bd4851"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
107
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 2AA4
0
0
Document
General
Full URL
https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:b800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
cdn-gl.imrworldwide.com
:scheme
https
:path
/novms/html/ls.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
cookie
IMRID=65d34ea6-c4df-4861-85fd-91311d00f64f
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
200
content-type
text/html
last-modified
Mon, 12 Aug 2019 17:38:40 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
1SR6kNxKWnz4xgTszjGjxW9zbX6Jzg9u
server
AmazonS3
content-encoding
gzip
date
Mon, 07 Oct 2019 13:43:38 GMT
cache-control
max-age=86400
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
PMmyf8Fj9Ie_08e2jgCBVJ0rhEInj-tOkam0ly-JrwRSLyuEnT5H9w==
age
2060
count-data.js
zdnet-1.disqus.com/
243 B
767 B
Script
General
Full URL
https://zdnet-1.disqus.com/count-data.js?1=84b0c8ef-41d0-4b8a-a999-2f800acf8635
Requested by
Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
9cfe765a0b23fc0698cf4c341ebae3daae61720c2100ffe69ef059639f8a3b0b
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Age
942
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
204
X-XSS-Protection
1; mode=block
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485344&de=590822819744&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=9&cb=0&ym=0&cu=1570456485344&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=29319009%3A147075009%3A130393329%3A43324823049&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=728&zMoatH=90&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1088392725&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
n.js
geo.moatads.com/ Frame 7E4F
107 B
281 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485499&de=141006294323&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=32&cb=0&ym=0&cu=1570456485499&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=371&zMoatH=771&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1085219089&cs=0&callback=MoatSuperV26.gna566136
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.89.170 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-89-170.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
2f75b42863ee097e17a88d040e00155990f838d0c3f0c8ba64f024a6c5a0a44a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
server
TornadoServer/4.5.3
etag
"6cd57f070af4ab60041ffe2b029a884bcd95bac8"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
107
integrator.js
adservice.google.de/adsid/ Frame 7E4F
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 7E4F
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019093001.js
securepubads.g.doubleclick.net/gpt/ Frame 7E4F
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js?21064710
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
7c5e8ae97d184389610b4deeab367ea2bcbe2108fd50b622546240eadc847a89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Sep 2019 13:06:17 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58932
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
carousel-1.0.js
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/
21 KB
4 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/carousel-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
338724
status
200
vary
Accept-Encoding
content-length
4361
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:36:49 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c411-5590"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 10 Oct 2019 15:49:22 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485354&de=630569132876&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=14&cb=0&ym=0&cu=1570456485354&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138248164645&zMoatPS=middle&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1106228186&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485364&de=415996258908&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=19&cb=0&ym=0&cu=1570456485364&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138248164876&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1454288491&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485410&de=431080844988&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=24&cb=0&ym=0&cu=1570456485410&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138239321475&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1577222448&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 7E4F
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2181808188204892&correlator=3367824350212332&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&eid=21064710%2C21063167%2C21063202%2C21063205&vrg=2019093001&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191007&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3Db7c7dd3f-6c92-4cae-9d07-4956dea78fec%7Cenv%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3Db7c7dd3f-6c92-4cae-9d07-4956dea78fec&cookie=ID%3D8da912c5cb60806f%3AT%3D1570456484%3AS%3DALNI_MaN-uZA-5XqaZjeW0cHxekzQSUdhg&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1570456485&dt=1570456485599&dlt=1570456485163&idt=420&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=9hnxhv5mdaps%7C2x726j1bu1pn&ifi=1&ifk=1867095887&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&dssz=17&icsg=43552&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1394065004.1570456486&ga_sid=1570456486&ga_hid=1113690696&fws=384%2C384&ohw=0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js?21064710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
c7ef6d4f2b30bfc08b7cc935c0c06df95f32fcc757cf5803e65e90f3505e0e8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7059
x-xss-protection
0
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239375540,138239375180
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019093001.js
securepubads.g.doubleclick.net/gpt/ Frame 7E4F
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js?21064710
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js?21064710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
25ee8438325f726833afbcc7f75f152d9640156bda461c1b4636275af51c5dbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Sep 2019 13:06:17 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24646
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 7E4F
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js?21064710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485421&de=239679674849&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=29&cb=0&ym=0&cu=1570456485421&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745696286%3A138239338545&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=970&zMoatH=66&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=970x66&zMoatSZPS=970x66%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1414378204&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485499&de=141006294323&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=34&cb=0&ym=0&cu=1570456485499&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=371&zMoatH=771&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1641764130&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 70A5
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsumjBqpdp5L_aV1WH_usi_uSMmZk6DF3cVd-u_RdwqF6PQeawiDTuLKj-_r0_hu8o6cqtbbj52-Lk7xLK33xVsYgFLzFk8l-9dVMgntWGvjsMSiracWEZaRs074h4m6UlLicxIfpZ-Vych_6ZRKNbmq9sBehTGeBdCOksVhSEwB70UEFOS2y0_4b3by3-LQYQL9f0xZIR0miWt_Zs39jNSRgPf_bpCs7UtE5ycT1nVuQnmwE702AQMdsOjiizqZQTKK1g&sig=Cg0ArKJSzLIXcJYYgfYqEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 70A5
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 70A5
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js?21064710
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/ Frame 7E4F
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js?21064710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
03cdd154a67240548616e679dde7dd00a53bbfb48697a1635bafef7fd09406c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29127
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 3583
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4GjusqwNTbIiDl_5C285CUMjon-NDa3I_txpCPqtYFMk7tN6qyyeqoaHClJ_6nLUwB3bHRT2puXo3H_B_bQ8dFwHwX9BpN_zZJH5oPodYUb57TQ1QEJ14O80hyZg-lpbFX88a_cU56n9p8GCgxm1dSaLZ0ez9YV1e0luZaxa8lsRyoMJy82zQQO0-G2tpi3vpy1B3nBc4ji3XjmkAaqWNima5rQ2T5JT6At2PIXQXR5n0i_vnxUpAlGr32YFnxd6PJQ&sig=Cg0ArKJSzM4oAwPckLaPEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 3583
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:45 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 3583
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js?21064710
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17247
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485830&de=253836899255&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=38&cb=0&ym=0&cu=1570456485830&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239375540&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=111084639&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
/
0211c814.akstat.io/
0
354 B
XHR
General
Full URL
https://0211c814.akstat.io/?h.pg=article&when=1570456485823&cdim.Site_View=desktop&t_other=custom3%7C738&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=75df23ec13011516b7b52444e11bd2479e070a22&h.t=1570456484843&http.initiator=api&rt.start=api&rt.si=33fb91fb-00ec-47cc-b75f-7805c9ad9c73&rt.ss=1570456485730&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Mon, 07 Oct 2019 13:54:45 GMT
/
inqlnfvog763mmf771rou737u.litix.io/
43 B
349 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.85.71.249 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-85-71-249.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/
0
56 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k1gh8qzx&c=504267091149&slotId=252133545574.5&eee=missing-element&bi=missing-id
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:45 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
OAS_Countdown_EG_5_700.webm
cbsadsales-a.akamaihd.net/Q1/
16 B
184 B
Media
General
Full URL
https://cbsadsales-a.akamaihd.net/Q1/OAS_Countdown_EG_5_700.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.88 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-88.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Date
Mon, 07 Oct 2019 13:54:45 GMT
Server
Apache
Connection
keep-alive
Content-Length
16
Content-Type
text/html; charset=iso-8859-1
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456485863&de=673275265821&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=42&cb=0&ym=0&cu=1570456485863&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239375180&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=46710323&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:45 GMT
cybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8
www.zdnet.com/video/manifest/
3 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/video/manifest/cybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
85b3dae4b2262b0dbcb979a985a9e696d3100620e258b8b476522def349402fb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
last-modified
Mon, 07 Oct 2019 13:28:17 GMT
vary
Accept-Encoding, User-Agent
content-length
393
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
x-newrelic-app-data
PxQCVVZaCAcTVVJaAQIAUVAAFB9AMQYAZBBZDEtZV0ZaClc9HiBQFg1ZWT1JFVFXVQs+BVJFaAsFX19VBxUXQBxSFlIICAQCH1UXUwNTAlZIGwZNRAcKUQIBBAMOBABWUFJSB1NETwRRDksHZQ==
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:46 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
c795e51e-fe45-47a7-9cd7-0a0a559262d3
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Mon, 07 Oct 2019 14:58:17 GMT
10d31225525ff5790a490d4d-adobeorg.xml
cbsinteractive.hb.omtrdc.net/settings/
228 B
624 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1570456486014
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.159.171.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-159-171-100.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:53:51 GMT
Last-Modified
Fri, 06 Sep 2019 08:23:11 GMT
Server
nginx
ETag
"5d72176f-e4"
Access-Control-Allow-Methods
OPTIONS,GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Location
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type
Content-Length
228
ads
securepubads.g.doubleclick.net/gampad/
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=742446501471087&correlator=4443947323511723&output=ldjh&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&eid=21062421%2C21062452%2C21063635%2C21064170%2C21064368%2C21064521%2C21064607&vrg=2019093001&guci=2.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191007&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11%2C641x321&fluid=height%2C0&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%26env%3Dprod%26firstpg%3D1%26vguid%3Db7c7dd3f-6c92-4cae-9d07-4956dea78fec%26session%3Df%26subses%3D6%26ftag%3DRSSbaffb68%257C&cookie=ID%3D8da912c5cb60806f%3AT%3D1570456484%3AS%3DALNI_MaN-uZA-5XqaZjeW0cHxekzQSUdhg&cookie_enabled=1&bc=31&abxe=1&lmt=1570455909&dt=1570456486031&dlt=1570456483000&idt=523&frm=20&biw=1585&bih=1200&oid=3&adxs=208%2C-12245933&adys=1838%2C-12245933&adks=2792964387%2C638705780&ucis=h%7Ci&ifi=10&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&dssz=99&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x11%7C770x2731&msz=770x11%7C641x361&psts=Ci4ItqWH1xFCA9GcH3gB6AG9_9T9ggSCAgyZ0q4H0eCgC5nQoQvRAkrNjZrVvTvK%2CCiYI8cmWPugBiazxsqEBggIMmdKuB9HgoAuZ0KEL0QJgHmh_jTWhGg%2CCi4Ilt3u1hFCA9GcH3gB6AGMrO6BgwSCAgyZ0q4H0eCgC5nQoQvRAhy82nQPCMxc%2CCi4Ilt3u1hFCA9GcH3gB6AGlqu6BgwSCAgyZ0q4H0eCgC5nQoQvRAscc2JUTxdjm%2CCi4Ilt3u1hFCA9GcH3gB6AGDy9L9ggSCAgyZ0q4H0eCgC5nQoQvRAqa68qtnoYo2%2CCi4Inqj21hFCA9GcH3gB6AGx0NP9ggSCAgyZ0q4H0eCgC5nQoQvRAoVJsP7zP_3Z%2CCicIhNOZ_RHoAbnfqIGDBIICDJnSrgfR4KALmdChC9ECjdjgpQWksv8&ga_vid=303970339.1570456485&ga_sid=1570456485&ga_hid=722491965&fws=4%2C132&ohw=1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019093001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
a55c8cbe529f4c1946ebd573323dd0adaab72dc8c2b74d88d7e8d801d81692f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7246
x-xss-protection
0
google-lineitem-id
4745189935,4745327422
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239344475,138239368367
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/
11 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a55a460fd170ec232ea41c381757b6675909e1e657b597c5d99dcd344a1cccae
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1648
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:46 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
605836d4-0e60-4b59-8822-d7a6006f9d9b
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Mon, 07 Oct 2019 13:54:46 GMT
s21404927885443
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/
43 B
224 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s21404927885443?AQB=1&ndh=1&pf=1&t=7%2F9%2F2019%2015%3A54%3A46%201%20-120&mid=28560213352085925183952595644052365448&aid=2ECDA1D27FFF8000-40117FFB4396DE59&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c.&siteEdition=eu&siteSection=editorial&siteType=responsive%20web&articleId=84b0c8ef-41d0-4b8a-a999-2f800acf8635&articleType=content_article&articleTitle=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&pageType=article&pageViewGuid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&videoAuthor=zdnet%20editors&Network=zdnet&tl=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&a.&contentType=vod&media.&name=4c93a0ae-cdc0-42e0-93cc-470df0252527&friendlyName=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&length=69&playerName=UVPJS_0.42.297&view=true&vsid=1570456486017198028951&.media&.a&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-130-224.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:45 GMT
x-content-type-options
nosniff
x-c
master-1023.I23979f.M0-290
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Tue, 08 Oct 2019 13:54:46 GMT
server
jag
xserver
anedge-5b97fbbbd9-ghdpk
etag
2ECDA1D305158000-400DEA80639AD3B0
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Sun, 06 Oct 2019 13:54:46 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
84 KB
19 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
obaker.241.1.1-10.23.1 /
Resource Hash
b76dd6ee844499da6d4848904e148e6ea19f800221b54e3bf6642c13de749d9a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
vERHKGIhMT.xCcTqt3uO5VmbPj3.3CUY
content-encoding
gzip
etag
"73836be4d3640f159c67458220377817e8de9442"
age
9313
x-cache
HIT
status
200
content-length
19062
x-amz-id-2
NPWr+WjFalsd9LddbbPNUZC3VYxRwgJ7NDv8d2GMrBLk1YHwnVxOSrw+bPEZpdRIw4Vf4/+tE3c=
x-served-by
cache-hhn4032-HHN
x-from-cache
1
access-control-allow-origin
*
last-modified
Wed, 02 Oct 2019 12:37:38 UTC
server
obaker.241.1.1-10.23.1
x-timer
S1570456486.134185,VS0,VE1
date
Mon, 07 Oct 2019 13:54:46 GMT
vary
Accept-Encoding, Accept-Encoding
x-amz-request-id
79283D92CB1A1B30
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
13
x-cache-hits
1
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&u=CWJvBpBbICeECR3Ifi&d=zdnet.com&g=65713&g0=security&g1=charlie%20osborne&n=1&f=00001&c=0.04&x=0&m=0&y=3799&o=1585&w=1200&j=30&R=1&W=0&I=0&E=2&e=2&r=&b=924&t=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&V=116&tz=-120&_acct=anon&_vi=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&_vp=/video/manifest/cybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8&_vdd=video%40zdnet.com&_vs=s1&_vt=ct&_vtn=null&_vd=69000&sn=2&sv=FpLz0D1h3-XIjNBpCq0Zv-Cgdg2s&sd=1&im=067b2ff3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:46 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame 7EEF
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvxcCi8O0aLYhha7h2draWsT_2M_gGf-bcDdebjNnJnhNfWwwNMykmBBjCVmfwLcuXgCm3HWFKOOzNMau0xP0Hug8fB3UIlWXKTSVTAakRxmReDPH47ny3XQv8jjCyrNYHZuvTNVpsr0OudHjyW7be3ta7becZmNQnmDPS5ctZ1aKJcGu9KieU3bd8dGm-tVIU6CRn7FBwy53Gxi7ZdON-vAoFO3IaiuiJBcsJtJfkE8MfgkbPNINZhLdcUSXw3ODESWA&sig=Cg0ArKJSzO3VviLawRvdEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 7EEF
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:46 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 7EEF
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17246
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 39A5
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuYux7hRWHLG9eu0fjjvZG9Cwub1CcZIvV4yn8xuNLXK_87HDD6M-ykuiJHlY-CYI0Gj5GQY8YedXvado2wO4tdy-tFS7XnNVua6sPCchVVAImbuboakPveWHJdUuisDkqeVimpt4YtxOB62r2Zd0mMRmCqjdt6aE_sYDYzIB6STN8mrpnDfHcHGcfnfWgn_DhmMvaTbhtgHcnGVrMLxx-jnBaOdXUM1y4pxvAh4swjcBwIsQyT5Zfrd-nFdbSP60_Nw&sig=Cg0ArKJSzGiX5ivJ4OywEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 07 Oct 2019 13:54:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 39A5
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1570187668844456"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29696
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:46 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 39A5
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019093001.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=17246
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:46 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Tue, 08 Oct 2019 13:54:46 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
etag
"fc0de48a0976cde02ddee0bd49a81832"
age
183
x-cache
HIT, HIT
status
200
content-length
4742
x-amz-id-2
Kxcl9JPUCPQHG3vaN6Jx/lGYzzwUySy7e4ETgKuAOOiaG/PNP6l62hhEjt8ysuzpghmLJlWgjo4=
x-served-by
cache-lax8636-LAX, cache-hhn4026-HHN
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1570456486.253749,VS0,VE0
date
Mon, 07 Oct 2019 13:54:46 GMT
vary
Accept-Encoding,,
x-amz-request-id
DF41DC503EB1F9E7
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
1, 1
impl.20191002-10-RELEASE.js
cdn.taboola.com/libtrc/
394 KB
112 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0cae80c9382e2b3e8045ba09797fd66d1a65a936d70af2eed09897be81ea436e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
MWFHdpWI_mQOMXUM8TI1gLlg0gl1K5pN
content-encoding
gzip
etag
"c863c8ea08069847bb5c761bac45dda6"
age
30
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
113914
x-amz-id-2
KZQ331HLPwKAM5p4SgPTw91EVwLUW1F6iCeqHyNr6GY8BJhdcyit1/M+5leJD7g4m2xQYShBEKA=
x-served-by
cache-hhn4032-HHN
last-modified
Wed, 02 Oct 2019 22:32:20 GMT
server
AmazonS3
x-timer
S1570456486.195802,VS0,VE0
date
Mon, 07 Oct 2019 13:54:46 GMT
vary
Accept-Encoding
x-amz-request-id
EC5559FF9EDC3E26
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
60
x-cache-hits
195
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800.m3u8
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800/
1 KB
475 B
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
360460cb3af23a7f0ad56aeeda3f01a9e3f0215f3f8f4f01e86cfd15fb4f9d59

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 11:56:30 GMT
server
AkamaiNetStorage
status
200
etag
"e05bded3a858a74215cad5b80d8f185c:1568116590"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
251
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456486224&de=521277619262&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=46&cb=0&ym=0&cu=1570456486224&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344475&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=11&zMoatH=11&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1683146768&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:46 GMT
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECDA1D27FFF8000-40117FFB4396DE59&s:user:mid=28560213352085925183952595644052365448&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570456486017198028951&s:event:type=start&l:event:duration=1&l:event:playhead=0&l:event:ts=1570456486024&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&s:asset:video_id=4c93a0ae-cdc0-42e0-93cc-470df0252527&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=69&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteEdition=eu&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=84b0c8ef-41d0-4b8a-a999-2f800acf8635&s:meta:articleType=content_article&s:meta:articleTitle=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&s:meta:pageType=article&s:meta:pageViewGuid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.159.171.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-159-171-100.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 07 Oct 2019 13:53:51 GMT
X-VaRouter-Backend
prod13
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECDA1D27FFF8000-40117FFB4396DE59&s:user:mid=28560213352085925183952595644052365448&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570456486017198028951&s:event:type=play&l:event:duration=0&l:event:playhead=0&l:event:ts=1570456486024&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&s:asset:video_id=4c93a0ae-cdc0-42e0-93cc-470df0252527&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=69&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.159.171.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-159-171-100.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 07 Oct 2019 13:53:51 GMT
X-VaRouter-Backend
prod13
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECDA1D27FFF8000-40117FFB4396DE59&s:user:mid=28560213352085925183952595644052365448&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570456486017198028951&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1570456486067&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&s:asset:video_id=4c93a0ae-cdc0-42e0-93cc-470df0252527&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=69&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.159.171.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-159-171-100.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 07 Oct 2019 14:00:11 GMT
X-VaRouter-Backend
prod13
Server
nginx
Connection
keep-alive
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570456486234&de=808586135181&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=50&cb=0&ym=0&cu=1570456486234&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=641&zMoatH=321&zMoatVGUID=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=277773673&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Mon, 07 Oct 2019 13:54:46 GMT
b
sb.scorecardresearch.com/
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1570456486297&ns_c=UTF-8&cv=3.1e&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
etag
"da73fb2066df9f51d08b6688cfb35441"
age
30160901
x-cache
HIT, HIT
status
200
content-length
91236
x-amz-id-2
T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by
cache-lax8632-LAX, cache-hhn4026-HHN
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1570456486.308538,VS0,VE0
date
Mon, 07 Oct 2019 13:54:46 GMT
vary
Accept-Encoding,,
x-amz-request-id
58FF20717A687DE4
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
text/javascript
x-cache-hits
1694, 55
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800_0.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800/
668 KB
670 KB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_800_0.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b23de91845b210d3e88e3f0662195f0d050e6325a3f25eb39a6069971d036b3a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
last-modified
Tue, 10 Sep 2019 11:56:31 GMT
server
AkamaiNetStorage
etag
"066cd2355a2a8ab12a77f69a1e1b4b25:1568116591"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
684132
15832ddc-f32b-472a-a94f-f60863a8d312
https://www.zdnet.com/
65 KB
0
Other
General
Full URL
blob:https://www.zdnet.com/15832ddc-f32b-472a-a94f-f60863a8d312
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
66527
Content-Type
text/javascript
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6280
date
Mon, 07 Oct 2019 12:10:06 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Mon, 07 Oct 2019 14:10:06 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 07 Oct 2019 13:54:46 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Tue, 08 Oct 2019 13:54:46 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 1DC4
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Mon, 07 Oct 2019 13:54:46 GMT
via
1.1 varnish
x-served-by
cache-hhn4026-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1570456486.389383,VS0,VE0
content-length
0
collect
www.google-analytics.com/r/
35 B
111 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=722491965&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&ul=en-us&de=UTF-8&dt=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=1732981298&gjid=131130555&cid=303970339.1570456485&tid=UA-33613588-22&_gid=833645270.1570456486&_r=1&cd2=other&z=412904853
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800.m3u8
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 KB
476 B
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f0f5bba6d26e0cf209747e38fce1a81bd2f58ad415de6c17eabc2021d6ee4f7d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 11:56:40 GMT
server
AkamaiNetStorage
status
200
etag
"752393c56f366ad91828c1f550b47dd1:1568116600"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
251
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fcybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8&i=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&g0=security&g1=charlie%20osborne&u=BSLGUkDIQT23C_1TE1&t=Qb7EbmBNPPWA8IPDK2Xu_W6tJR&x=0&y=0&V=116&VS=VS&n=1&b=1627&_vd=69000&_vi=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&_vh=zdnet.com&_pu=CWJvBpBbICeECR3Ifi&_pt=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.00046100000000000004&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0.02&W=0&R=1&I=0&E=0&j=20&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:46 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_1.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_1.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ac862c10a86296fb7bcd912b8d7aad7e62a3f2325fe79d7e5ae726827caee3aa

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
last-modified
Tue, 10 Sep 2019 11:56:42 GMT
server
AkamaiNetStorage
etag
"f85985c36978e6f53d5d70958ad53407:1568116602"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1225572
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1795155
cf-ray
52205e712ea6cba4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Mon, 07 Oct 2019 14:24:46 GMT
0.599400786303069
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
161 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.599400786303069?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=a+year+after+patch%2C+drupalgeddon2+is+still+being+employed+in+cybercriminal+attacks&v22=content_article&v23=&v24=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&v30=84b0c8ef-41d0-4b8a-a999-2f800acf8635&v60=33161585,33166656,33165321&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=20191071-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-130-224.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
x-content-type-options
nosniff
x-c
master-1023.I23979f.M0-290
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Tue, 08 Oct 2019 13:54:46 GMT
server
jag
xserver
anedge-5b97fbbbd9-6fnpp
etag
2ECDA1D37FFF8000-40091FFF439B8F95
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Sun, 06 Oct 2019 13:54:46 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=84b0c8ef-41d0-4b8a-a999-2f800acf8635&assettitle=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&assettype=content_article&pubdate=2019-10-07%2013%3A00%3A00&viewguid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&devicetype=desktop&sitetype=responsive%20web&author=charlie%20osborne&authorid=79d67b90-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=84b0c8ef-41d0-4b8a-a999-2f800acf8635&v16=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1570456486582&tcset=utf8&im=dsjs&title=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=632
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
p
sb.scorecardresearch.com/
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1570456485106&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=69000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=4c93a0ae-cdc0-42e0-93cc-470df0252527&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1570456486595&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1489&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C0_42_297&c4=3000074&c6=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c8=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 1729
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Mon, 07 Oct 2019 13:54:46 GMT
via
1.1 varnish
x-served-by
cache-hhn4026-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1570456487.635039,VS0,VE0
content-length
0
domains
api.viglink.com/api/
42 B
487 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
c4df9500705d85c63296f2e32bd76bc5e733835801f150c7234f81f115a59e7b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:45 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_2.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_2.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2b8a1a9cf77511e40cebbace9bc942fcea37e21bd48bdb2177a621e51ed383f0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
last-modified
Tue, 10 Sep 2019 11:56:45 GMT
server
AkamaiNetStorage
etag
"527460a47f931e15da4a93a0dcfb50f0:1568116605"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1287048
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_3.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_3.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9343db07f0ec1e9c6ec54db33a8cb1778430a5ad3abbdc1f86d8989b8b9b44e5

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:46 GMT
last-modified
Tue, 10 Sep 2019 11:56:46 GMT
server
AkamaiNetStorage
etag
"baa8e8920618c3c74c0591a71ad09518:1568116606"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1210532
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_4.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_4.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a0b64ceaecadf77483db282afd086e3567e5ef7a2618ae5544302e0c3d1e0685

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:47 GMT
server
AkamaiNetStorage
etag
"9adf8225e3439c4d0abf89eb2c2dc6af:1568116607"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1326528
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
13 KB
5 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=15%3A54%3A47.133&lti=deflated&data=%7B%22id%22%3A705%2C%22ii%22%3A%22%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1570456487131%2C%22cv%22%3A%2220191002-10-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A3818%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A3388.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
cfcb9a7fdd096c0415e6facd33001be8ee0718fe0a0a365b755f10603445219d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
content-encoding
gzip
server
nginx
x-timer
S1570456487.147109,VS0,VE135
status
200
x-served-by
cache-fra19135-FRA
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_5.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_5.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
26c58bf78d522c3e0150919a8aa7c9d8a7a252c762a3cc44eddd525c08ac7b1c

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:48 GMT
server
AkamaiNetStorage
etag
"f5382007fb209836f5b696b404c857cb:1568116609"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1309608
userx.20191002-10-RELEASE.es6.js
cdn.taboola.com/libtrc/
22 KB
8 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20191002-10-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e85ba4d66717e8de5dcba1b5e0285ced20874b84f316ff3c0840277352b9c9ea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
7czDtX8TJp.OUfK2QYR9kQhkSDorEoft
content-encoding
gzip
etag
"68efda98343f3a646119692abafb484d"
age
93
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
7734
x-amz-id-2
QPd6mBrMe7OS2Q0zCsGsUkKeOz9Fp/l+LNeHi9xyDpuo955im+Taey5jlU5+sdQU3GQtF/V4yz8=
x-served-by
cache-hhn4032-HHN
last-modified
Wed, 02 Oct 2019 22:32:45 GMT
server
AmazonS3
x-timer
S1570456487.339653,VS0,VE0
date
Mon, 07 Oct 2019 13:54:47 GMT
vary
Accept-Encoding
x-amz-request-id
0C72CF643987F764
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
60
x-cache-hits
239
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
55 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&tvi2=-2&lti=deflated&ri=bbece6c6fceeed3878bf2712a14a3cfe&sd=v2_1dbe87cf267090dcfc294097bdd744f1_65fb825d-e285-443b-b325-0879b6191b53-tuct494c927_1570456487_1570456487_CNawjgYQzro_GNuJgbTaLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&wi=-3708014022670700664&pt=text&vi=1570456487131&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=15%3A54%3A47.338&id=5318&llvl=1&cv=20191002-10-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish
server
nginx
x-timer
S1570456487.353373,VS0,VE9
x-served-by
cache-fra19135-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
55 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&tvi2=-2&lti=deflated&ri=bbece6c6fceeed3878bf2712a14a3cfe&sd=v2_1dbe87cf267090dcfc294097bdd744f1_65fb825d-e285-443b-b325-0879b6191b53-tuct494c927_1570456487_1570456487_CNawjgYQzro_GNuJgbTaLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&wi=-3708014022670700664&pt=text&vi=1570456487131&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A336%2C%22ly%22%3A413%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=15%3A54%3A47.338&id=5888&llvl=1&cv=20191002-10-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish
server
nginx
x-timer
S1570456487.353365,VS0,VE9
x-served-by
cache-fra19135-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
84 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&tvi2=-2&lti=deflated&ri=bbece6c6fceeed3878bf2712a14a3cfe&sd=v2_1dbe87cf267090dcfc294097bdd744f1_65fb825d-e285-443b-b325-0879b6191b53-tuct494c927_1570456487_1570456487_CNawjgYQzro_GNuJgbTaLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks&wi=-3708014022670700664&pt=text&vi=1570456487131&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A592%2C%22ly%22%3A413%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=15%3A54%3A47.338&id=3355&llvl=1&cv=20191002-10-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish
server
nginx
x-timer
S1570456487.353358,VS0,VE9
x-served-by
cache-fra19135-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
73 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?tvi2=-2&route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish
server
nginx
x-timer
S1570456487.359752,VS0,VE10
x-served-by
cache-fra19135-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4b985401a0cb64b9e88935039dbfebd88c276c78603f1ff0b09288008afca20

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1170454
edge-cache-tag
546565962036603792738435367973659321550,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
content-length
14213
x-served-by
cache-hhn4064-HHN, cache-hhn4032-HHN
last-modified
Sun, 15 Sep 2019 19:50:41 GMT
server
cloudinary
x-timer
S1570456487.360403,VS0,VE0
etag
"30ee0098be00663c3f3cc9120ca0a689"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
4e67df7edbd0287dbd55082bf2d0879b.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4e67df7edbd0287dbd55082bf2d0879b.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c29668f8a0bc99ad96beb8c89ad726ba073d26b211e370a8af0cd57ebfb36a44

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1142707
edge-cache-tag
461479769804688959608247783745686170190,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 02 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4e67df7edbd0287dbd55082bf2d0879b.png
content-length
9721
x-served-by
cache-hhn4082-HHN, cache-hhn4032-HHN
last-modified
Sun, 01 Sep 2019 13:49:54 GMT
server
cloudinary
x-timer
S1570456487.361170,VS0,VE0
etag
"4ed9a7baec5e57b9230f1aa53ae017b8"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
7e016667a06c3953bbd551436b1db2b6.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7e016667a06c3953bbd551436b1db2b6.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8ec53f9bc47577505d655fdfc610cd320430d24193582b9f2b597be832ca810c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1684835
edge-cache-tag
482821531515689230506783830797345189770,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 04 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7e016667a06c3953bbd551436b1db2b6.jpeg
content-length
12802
x-served-by
cache-hhn4081-HHN, cache-hhn4032-HHN
last-modified
Tue, 03 Sep 2019 16:06:33 GMT
server
cloudinary
x-timer
S1570456487.360428,VS0,VE0
etag
"4f47282ada21325de8d68ef84642c435"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
20 KB
20 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1d6c3c621c4147594db5ca8ed0c57dbf3023fe6a75223c65fe38119741a31872

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
881389
edge-cache-tag
318078698408600398059595195911836926211,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 22 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
content-length
20085
x-served-by
cache-hhn4075-HHN, cache-hhn4032-HHN
last-modified
Sat, 21 Sep 2019 17:52:22 GMT
server
cloudinary
x-timer
S1570456487.360437,VS0,VE0
etag
"36785f851b60270f5f64a79d7af32ff1"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
c9539f3712b24bcb511cbeb7a8c3d34b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9539f3712b24bcb511cbeb7a8c3d34b.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2561e72c62ab716f87767e67897b5c769b84eb71562c3cdd76950f7c14b4cd86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1934222
edge-cache-tag
406673519296986451749583371413626552821,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 15 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9539f3712b24bcb511cbeb7a8c3d34b.jpg
content-length
10602
x-served-by
cache-hhn4050-HHN, cache-hhn4032-HHN
last-modified
Thu, 15 Aug 2019 12:28:02 GMT
server
cloudinary
x-timer
S1570456487.361171,VS0,VE0
etag
"e8fef20fe348c10fd5ec15a739231554"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
39694c01a83cbbb941541db069b89836.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39694c01a83cbbb941541db069b89836.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8d5a312a5ab9da7ef3231930eea712faa40cb7c56891ad6cc3b882335f1349f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1165828
edge-cache-tag
518329573700235898705196811312404767330,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 01 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39694c01a83cbbb941541db069b89836.jpg
content-length
10234
x-served-by
cache-hhn4047-HHN, cache-hhn4032-HHN
last-modified
Sat, 31 Aug 2019 17:19:05 GMT
server
cloudinary
x-timer
S1570456487.361187,VS0,VE0
etag
"476e49394600f2e970fe94bc2b13715b"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
871870942__Sl84VKlq.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/871870942__Sl84VKlq.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
e6ce7cb65f2d52b79ccf0c4efa9c63ee4b6a43ab89631c768b25efbb3927272d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1197881
edge-cache-tag
446934761746712140137091629586300001565,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 17 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/871870942__Sl84VKlq.jpg
content-length
12829
x-served-by
cache-hhn4032-HHN, cache-hhn4032-HHN
last-modified
Mon, 16 Sep 2019 09:59:16 GMT
server
cloudinary
x-timer
S1570456487.388996,VS0,VE0
etag
"1e203a742bd3aeb1d93a92f2e83aa630"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 57
steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/
15 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
4c36e41bca3afb9243b837566da9e283ec9c73b639f9eb62fd4319f609b6addd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
2264839
edge-cache-tag
338346392001086770476079059451373585057,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
content-length
15701
x-served-by
cache-hhn4059-HHN, cache-hhn4032-HHN
last-modified
Wed, 11 Sep 2019 07:12:53 GMT
server
cloudinary
x-timer
S1570456487.388978,VS0,VE0
etag
"d26955fcb481cd91fd3b2b3e15588d61"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
723 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
23188
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by
cache-hhn4032-HHN
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1570456487.387754,VS0,VE0
date
Mon, 07 Oct 2019 13:54:47 GMT
x-amz-request-id
29D722C296265892
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
60
x-cache-hits
63806
Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4b985401a0cb64b9e88935039dbfebd88c276c78603f1ff0b09288008afca20

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1170454
edge-cache-tag
546565962036603792738435367973659321550,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
content-length
14213
x-served-by
cache-hhn4064-HHN, cache-hhn4032-HHN
last-modified
Sun, 15 Sep 2019 19:50:41 GMT
server
cloudinary
x-timer
S1570456487.396999,VS0,VE0
etag
"30ee0098be00663c3f3cc9120ca0a689"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4
7e016667a06c3953bbd551436b1db2b6.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7e016667a06c3953bbd551436b1db2b6.jpeg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8ec53f9bc47577505d655fdfc610cd320430d24193582b9f2b597be832ca810c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1684835
edge-cache-tag
482821531515689230506783830797345189770,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 04 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7e016667a06c3953bbd551436b1db2b6.jpeg
content-length
12802
x-served-by
cache-hhn4081-HHN, cache-hhn4032-HHN
last-modified
Tue, 03 Sep 2019 16:06:33 GMT
server
cloudinary
x-timer
S1570456487.397113,VS0,VE0
etag
"4f47282ada21325de8d68ef84642c435"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
20 KB
20 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1d6c3c621c4147594db5ca8ed0c57dbf3023fe6a75223c65fe38119741a31872

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
881389
edge-cache-tag
318078698408600398059595195911836926211,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 22 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b6f858d89bd46b5d42bc7e497b3cdc6.jpg
content-length
20085
x-served-by
cache-hhn4075-HHN, cache-hhn4032-HHN
last-modified
Sat, 21 Sep 2019 17:52:22 GMT
server
cloudinary
x-timer
S1570456487.401867,VS0,VE0
etag
"36785f851b60270f5f64a79d7af32ff1"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
c9539f3712b24bcb511cbeb7a8c3d34b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9539f3712b24bcb511cbeb7a8c3d34b.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2561e72c62ab716f87767e67897b5c769b84eb71562c3cdd76950f7c14b4cd86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1934222
edge-cache-tag
406673519296986451749583371413626552821,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 15 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c9539f3712b24bcb511cbeb7a8c3d34b.jpg
content-length
10602
x-served-by
cache-hhn4050-HHN, cache-hhn4032-HHN
last-modified
Thu, 15 Aug 2019 12:28:02 GMT
server
cloudinary
x-timer
S1570456487.401887,VS0,VE0
etag
"e8fef20fe348c10fd5ec15a739231554"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
4e67df7edbd0287dbd55082bf2d0879b.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4e67df7edbd0287dbd55082bf2d0879b.png
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c29668f8a0bc99ad96beb8c89ad726ba073d26b211e370a8af0cd57ebfb36a44

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1142707
edge-cache-tag
461479769804688959608247783745686170190,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 02 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4e67df7edbd0287dbd55082bf2d0879b.png
content-length
9721
x-served-by
cache-hhn4082-HHN, cache-hhn4032-HHN
last-modified
Sun, 01 Sep 2019 13:49:54 GMT
server
cloudinary
x-timer
S1570456487.414484,VS0,VE0
etag
"4ed9a7baec5e57b9230f1aa53ae017b8"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
39694c01a83cbbb941541db069b89836.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39694c01a83cbbb941541db069b89836.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8d5a312a5ab9da7ef3231930eea712faa40cb7c56891ad6cc3b882335f1349f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1165828
edge-cache-tag
518329573700235898705196811312404767330,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 01 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39694c01a83cbbb941541db069b89836.jpg
content-length
10234
x-served-by
cache-hhn4047-HHN, cache-hhn4032-HHN
last-modified
Sat, 31 Aug 2019 17:19:05 GMT
server
cloudinary
x-timer
S1570456487.415241,VS0,VE0
etag
"476e49394600f2e970fe94bc2b13715b"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_6.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_6.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c1f3bc0936afce66cb83467e1446ed5d74663c80fb40a33e8da9d98eba9df9fd

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:49 GMT
server
AkamaiNetStorage
etag
"c71fcf7019bf6b3d5e37aeeeda32953e:1568116609"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1355668
871870942__Sl84VKlq.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/871870942__Sl84VKlq.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
e6ce7cb65f2d52b79ccf0c4efa9c63ee4b6a43ab89631c768b25efbb3927272d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
1197881
edge-cache-tag
446934761746712140137091629586300001565,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 17 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/871870942__Sl84VKlq.jpg
content-length
12829
x-served-by
cache-hhn4032-HHN, cache-hhn4032-HHN
last-modified
Mon, 16 Sep 2019 09:59:16 GMT
server
cloudinary
x-timer
S1570456487.423632,VS0,VE0
etag
"1e203a742bd3aeb1d93a92f2e83aa630"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 58
steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/
15 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
4c36e41bca3afb9243b837566da9e283ec9c73b639f9eb62fd4319f609b6addd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
via
1.1 varnish, 1.1 varnish
age
2264839
edge-cache-tag
338346392001086770476079059451373585057,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/8e18ab28-d266-4513-97fe-d0fc6b74199a/steakonplate_1000x600_7a1fc0566a2e10a180beca4b62e77b26.png
content-length
15701
x-served-by
cache-hhn4059-HHN, cache-hhn4032-HHN
last-modified
Wed, 11 Sep 2019 07:12:53 GMT
server
cloudinary
x-timer
S1570456487.423664,VS0,VE0
etag
"d26955fcb481cd91fd3b2b3e15588d61"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&u=CWJvBpBbICeECR3Ifi&d=zdnet.com&g=65713&g0=security&g1=charlie%20osborne&n=1&f=00001&c=0.06&x=0&m=0&y=4346&o=1585&w=1200&j=30&R=1&W=0&I=0&E=3&e=1&r=&b=924&t=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&V=116&tz=-120&_acct=anon&_vi=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&_vp=/video/manifest/cybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=69000&sn=3&sv=FpLz0D1h3-XIjNBpCq0Zv-Cgdg2s&sd=1&im=067b2ff3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_7.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_7.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
6056ed3b6991fa938dfe44e00312c415a8b2db5869efdce6546f212983183698

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:50 GMT
server
AkamaiNetStorage
etag
"4ba2f188886bcecb645d91c92f5137af:1568116610"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1372776
domains
api.viglink.com/api/
163 B
843 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
bafb7f155a06996326a2d76d27e4470f8dd157370b390c2f4c281b210afc35d8

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:46 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
163
Expires
Thu, 01 Jan 1970 00:00:00 GMT
gn
secure-us.imrworldwide.com/cgi-bin/
44 B
424 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=us-700144&ch=us-700144_c01_P&asn=defChnAsset&sessionId=8mF0Kru2UlQfe4pTijFvA71jfJVKE1570456485&tl=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&prv=1&c6=vc,c01&ca=us-700144_c01_4c93a0ae-cdc0-42e0-93cc-470df0252527&cg=ZDNet%20Video&c13=asid,PF7B87067-BF4D-F80F-E040-070AAD316CE6&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,UVPJS|0_42_297&plugv=&playerv=&sup=0&segment2=&segment1=&forward=1&ad=0&cr=4_00_99_V1_00000&c9=devid,&enc=true&c1=nuid,999&at=view&rt=video&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,15704564854413656&c30=bldv,6.0.0.428&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,4c93a0ae-cdc0-42e0-93cc-470df0252527&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&sd=69&devtypid=&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=4c93a0ae-cdc0-42e0-93cc-470df0252527&c3=st,c&c64=starttm,1570456487&adid=4c93a0ae-cdc0-42e0-93cc-470df0252527&c58=isLive,false&c59=sesid,isu12CuCEioytTiZxa2qQd05jDepY1570456487&c61=createtm,1570456486&c63=pipMode,&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c77=adsuprt,1&uoo=&evdata=&c71=ottflg,0&c72=otttyp,none&c44=progen,&davty=0&si=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C&c66=mediaurl,&c62=sendTime,1570456486&rnd=481928
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.214.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-18-214-98.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/
44 B
424 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15704564854413656&c30=bldv,6.0.0.428&c6=vc,c01&c3=&cg=ZDNet%20Video&tl=dav0-Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&pr=iag.epi,Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1570456486&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1570456486&rnd=463044
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.214.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-18-214-98.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Oct 2019 13:54:47 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_8.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_8.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4b524ae7335a598c597e5cbc49711de64d45e485e54632ce5c7ddfc4e3c075f7

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:51 GMT
server
AkamaiNetStorage
etag
"991380840ac562cfeba985d30bd154e5:1568116611"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1297012
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_9.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_9.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f7f2bdaa627c83bbf5853b182fa32d27f2876c431979080c783bb49e941bd44b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:47 GMT
last-modified
Tue, 10 Sep 2019 11:56:52 GMT
server
AkamaiNetStorage
etag
"4499b8f01e930ad65d5f91989deb1436:1568116612"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1309796
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_10.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_10.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a8dc3eb83d03ca9f155c527e3eb74da68c184e33ead202e5d60912b923270ce1

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:48 GMT
last-modified
Tue, 10 Sep 2019 11:56:43 GMT
server
AkamaiNetStorage
etag
"d3ff874d63164abd6bf7570a1acc3298:1568116603"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1560024
2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_11.ts
techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/
379 KB
380 KB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2019/09/10/1600819267740/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800/2019-09-10-wochit-cybersecurity-clicking-email-links-could-put-your-data-at-risk_1930442_1800_11.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.107 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-107.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
02da9066b91e23e312431d263cc1b6e0d13b06b7e0c6ded8b1363712d332d4e2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:48 GMT
last-modified
Tue, 10 Sep 2019 11:56:44 GMT
server
AkamaiNetStorage
etag
"9182a6c793739d2bbab4916349e8f93c:1568116604"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
387844
settings.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/
7 KB
5 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/settings.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:48 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
2VqL9ACwktkYsY/Ec2Z++Q==
age
587492
cf-polished
origSize=7074
status
200
last-modified
Mon, 23 Sep 2019 18:34:57 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
7084f032-801e-009d-7b3d-722f81000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
52205e7d0e3f8c74-VIE
expires
Tue, 06 Oct 2020 13:54:48 GMT
lightbox_builder.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame C22F
200 KB
28 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:48 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
DPY02gsPpNVzBSyytYwMZw==
age
587933
cf-polished
origSize=326600
status
200
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
3afa8c39-501e-0131-7d3d-724843000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
52205e7d0e498c74-VIE
expires
Tue, 06 Oct 2020 13:54:48 GMT
css
fonts.googleapis.com/ Frame C22F
783 B
440 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 07 Oct 2019 13:54:48 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 07 Oct 2019 13:54:48 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 07 Oct 2019 13:54:48 GMT
fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/
1 KB
1 KB
Image
General
Full URL
https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
status
200
etag
W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
date
Mon, 07 Oct 2019 13:54:48 GMT
accept-ranges
bytes
timing-allow-origin
*
content-length
1362
x-served-by
cache-ams21020-AMS, cache-hhn4037-HHN
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame C22F
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Raleway
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 25 Aug 2019 01:25:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:04 GMT
server
sffe
age
3760151
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13428
x-xss-protection
0
expires
Mon, 24 Aug 2020 01:25:37 GMT
t.gif
www.lightboxcdn.com/z9g/
35 B
286 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1570456489119&h=www.zdnet.com&e=i&u=40913&b=193988&v=2544&s=empty
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 07 Oct 2019 13:54:49 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
284014
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
52205e81091e8c74-VIE
cf-bgj
imgq:85
/
inqlnfvog763mmf771rou737u.litix.io/
43 B
349 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.85.71.249 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-85-71-249.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Mon, 07 Oct 2019 13:54:51 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fcybersecurity-clicking-email-links-could-put-your-data-at-risk.m3u8&i=Cybersecurity%3A%20Clicking%20email%20links%20could%20put%20your%20data%20at%20risk&g0=security&g1=charlie%20osborne&u=BSLGUkDIQT23C_1TE1&t=Qb7EbmBNPPWA8IPDK2Xu_W6tJR&x=0&y=0&V=116&VS=VS&n=1&b=1627&_vd=69000&_vi=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F&_vh=zdnet.com&_pu=CWJvBpBbICeECR3Ifi&_pt=BRoBWsBcIdm9CYC1hZCxmaIwDj9v84&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.005461000000000001&_vpt=4.9429&_vaup=man&_vplt=0.42.297&_vce=5&c=0.11&W=0&R=1&I=0&E=5&j=20&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.62.87 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-20-62-87.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 07 Oct 2019 13:54:51 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
/
www.zdnet.com/homepage/xhr/
250 KB
28 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b611ca52f1f37c5aefe7666a35b056a10b197ea00140d1189843961667c1bc0f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
26862
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 07 Oct 2019 12:54:02 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:54 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
0af169a3-6fa5-45f5-b291-47a62fb077b6
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Mon, 07 Oct 2019 14:24:02 GMT
ring.gif
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ring.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425490
status
200
vary
Accept-Encoding
content-length
9039
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-3f75"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:17 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425490
status
200
vary
Accept-Encoding
content-length
1513
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-6fa"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:17 GMT
ZDLogoMicroWhite-x2.png
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/
2 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
425493
status
200
vary
Accept-Encoding
content-length
1398
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:35:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d94c3bf-691"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 15:43:18 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
753 B
697 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
115334
status
200
vary
Accept-Encoding
content-length
426
x-xss-protection
1; mode=block
last-modified
Wed, 02 Oct 2019 15:37:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d94c451-2f1"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 13 Oct 2019 05:52:39 GMT
tr-premium-promo-49ebdaab89-rev.js
zdnet2.cbsistatic.com/fly/js/components/
461 B
395 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
453796
status
200
vary
Accept-Encoding
content-length
287
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:04:57 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d936b19-1cd"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Oct 2019 07:51:38 GMT
load-more-34f6119ea4-rev.js
zdnet3.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537639
status
200
vary
Accept-Encoding
content-length
1803
x-xss-protection
1; mode=block
last-modified
Mon, 30 Sep 2019 12:30:51 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d91f57b-12a2"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 08:31:02 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b86f6fa61b5e9ced547beb544b2677cf3aaee7deffde1677105fbf6b94c82df8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
735
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:55 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
bf9929a9-1098-4a96-98b4-60b0d0f379dd
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Mon, 07 Oct 2019 13:54:55 GMT
/
www.zdnet.com/m3d0s1/xhr/horizontal/
14 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a0a377a73685e4b64df0f34d1121035a64553b075690bc46aa9aafdf4f4329ba
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1772
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:55 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
e0f26665-8763-42e1-b6d6-20225f186a61
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Mon, 07 Oct 2019 13:54:55 GMT
/
www.zdnet.com/components/tr-promo-asset/xhr/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5a790924bbd7b891ef628a13280ec72f24b60c65c34c8ef9c7c16d60358975a5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
637
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 07 Oct 2019 12:37:06 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 07 Oct 2019 13:54:55 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
8de375fd-9c47-4ee2-88ce-ef4972262db2
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Mon, 07 Oct 2019 14:07:06 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/
8 KB
3 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
503253
status
200
vary
Accept-Encoding
content-length
2472
x-xss-protection
1; mode=block
last-modified
Tue, 01 Oct 2019 15:03:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d936ad3-1f51"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 08 Oct 2019 18:07:20 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1580936
status
200
vary
Accept-Encoding
content-length
3552
x-xss-protection
1; mode=block
last-modified
Wed, 18 Sep 2019 19:25:47 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8284bb-f53"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Sep 2019 06:45:23 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:55 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1795164
cf-ray
52205ea748afcba4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Mon, 07 Oct 2019 14:24:55 GMT
0.5868252534996221
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
206 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.5868252534996221?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN4f4b3a2&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=a+year+after+patch%2C+drupalgeddon2+is+still+being+employed+in+cybercriminal+attacks&v22=content_article&v23=&v24=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&v30=84b0c8ef-41d0-4b8a-a999-2f800acf8635&v60=33135367,33073597,177504,33157532&v64=2149&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=20191071-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-130-224.eu-west-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 07 Oct 2019 13:54:55 GMT
x-content-type-options
nosniff
x-c
master-1023.I23979f.M0-290
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Tue, 08 Oct 2019 13:54:55 GMT
server
jag
xserver
anedge-5b97fbbbd9-clrbh
etag
2ECDA1D785158000-401848E6239B311D
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Sun, 06 Oct 2019 13:54:55 GMT
e.gif
dw.cbsi.com/levt/ria/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dw.cbsi.com
URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=84b0c8ef-41d0-4b8a-a999-2f800acf8635&assettitle=a%20year%20after%20patch%2C%20drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks&assettype=content_article&pubdate=2019-10-07%2013%3A00%3A00&viewguid=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&devicetype=desktop&sitetype=responsive%20web&author=charlie%20osborne&authorid=79d67b90-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=84b0c8ef-41d0-4b8a-a999-2f800acf8635&v16=b7c7dd3f-6c92-4cae-9d07-4956dea78fec&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1570456495243&tcset=utf8&im=dsjs&title=A%20year%20after%20patch%2C%20Drupalgeddon2%20is%20still%20being%20employed%20in%20cybercriminal%20attacks%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fold-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks%2F%23ftag%3DRSSbaffb68%7C

Verdicts & Comments Add Verdict or Comment

327 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| knownServiceWorkers object| _sf_async_config number| _sf_startpt object| _cbq object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define function| $ function| jQuery function| renderAdCallback function| blankAdCallback number| BOOMR_lstart object| _sp_ object| jQuery18304133314255572036 object| googletag object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| BOOMR object| BOOMR_mq object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit number| google_srt undefined| google_measure_js_timing function| lightboxjs function| lightboxlib number| BOOMR_configt boolean| __v5k function| vl_cB function| vl_disable function| vglnk_15704564835466 function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in object| _bmrEvents function| Visitor object| visitor function| DIL number| s_objectID number| s_giq object| _ml function| dw_callback object| EF undefined| easyXDM object| AudEng object| URS object| Modernizr function| Waypoint number| _sf_endpt function| VideoStrategy object| _cbv_strategies object| debug string| firstpgvar object| __ql string| path string| host object| scriptTags object| DIGIOH_API object| LIGHTBOX_API object| CryptoJS object| mPulseApp object| _cb_shared object| pSUPERFLY_mab object| pSUPERFLY object| pSUPERFLY_video object| _cbv undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming object| TRUE_ANTHEM object| headertag function| headertag_render object| pbjs undefined| vglnk_15704564840477 object| DW function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr undefined| vglnk_15704564842179 object| s_i_cnetzdnetglobalsite string| adBlockCookieValue object| $tealium boolean| google_noFetch number| __google_ad_urls_id number| BOOMR_onload object| ret boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey function| udm_ function| ns_order object| ns_ object| ns_p function| fbq function| _fbq string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal undefined| jQuery171043415887113668616_1570456483659 object| trx object| UA object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| google object| QSI string| disqus_shortname number| _rnd string| __prot object| __i function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| ADB object| NOLCMB object| platform function| mux object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| closure_lm_441477 object| NOLBUNDLE function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| MoatDataJsonpRequest object| closure_lm_815158 object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents object| DISQUSWIDGETS undefined| disqus_domain object| jQuery171043415887113668616 object| _taboola object| TRC object| _tblConsole object| _comscore undefined| msg string| pm_pgtp function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl object| COMSCORE string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaData undefined| vglnk_157045648664010 number| taboola_view_id undefined| vglnk_157045648768411

31 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 28792544919415854063931073179838359024
.lightboxcdn.com/ Name: __cfduid
Value: d6cf56bcbf8052fede99533e345f920991570456483
.zdnet.com/ Name: RT
Value: "sl=1&ss=1570456482764&tt=1676&obo=0&bcn=%2F%2F0211c814.akstat.io%2F&sh=1570456484444%3D1%3A0%3A1676&dm=zdnet.com&si=33fb91fb-00ec-47cc-b75f-7805c9ad9c73&ld=1570456484444"
.zdnet.com/ Name: utag_main
Value: v_id:016da6803690003a67e8d553c5e400079007607100b08$_sn:1$_ss:0$_st:1570458284423$ses_id:1570456483473%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: s_cc
Value: true
.zdnet.com/ Name: fly_default_edition
Value: eu
www.zdnet.com/ Name: _cb
Value: CWJvBpBbICeECR3Ifi
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C28560213352085925183952595644052365448%7CMCAAMLH-1571061284%7C6%7CMCAAMB-1571061284%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1570463684s%7CNONE%7CMCAID%7C2ECDA1D27FFF8000-40117FFB4396DE59%7CvVersion%7C2.3.0
.demdex.net/ Name: dextp
Value: 269-1-1570456484251|477-1-1570456484352|771-1-1570456484456
www.zdnet.com/ Name: viewGuid
Value: b7c7dd3f-6c92-4cae-9d07-4956dea78fec
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/ Name: s_invisit
Value: true
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: s_lv_zdnet
Value: 1570456484061
www.zdnet.com/ Name: _ccmsi
Value: 1570456483745_hvbbdharo|1570456483745
.zdnet.com/ Name: aam_uuid
Value: 28792544919415854063931073179838359024
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
www.zdnet.com/ Name: _cb_svref
Value: null
.zdnet.com/ Name: s_getNewRepeat
Value: 1570456484061-New
www.zdnet.com/ Name: _chartbeat2
Value: .1570456483679.1570456483679.1.FpLz0D1h3-XIjNBpCq0Zv-Cgdg2s.1
.zdnet.com/ Name: s_vnum
Value: 1573048484059%26vn%3D1
.zdnet.com/ Name: first_page_today
Value: false
.zdnet.com/ Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D
.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks Name: CBS_INTERNAL
Value: 0
www.zdnet.com/ Name: XCLGFbrowser
Value: Zp7uuV2bQ6OxZaj2eTs
.zdnet.com/ Name: fly_preferred_edition
Value: eu
www.zdnet.com/ Name: _ccmaid
Value: 5978151505733031935
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "nl"}
www.zdnet.com/ Name: _cb_ls
Value: 1
www.zdnet.com/ Name: LDCLGFbrowser
Value: af4553ee-2aa8-47d8-b335-196620d95399
www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks Name: zdnet_ad_ftag
Value: RSSbaffb68%7C

87 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 757)
Message:
ADS: queuing nav-ad-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1227)
Message:
ADS: queuing intromercial-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1294)
Message:
ADS: queuing leader-plus-top-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1455)
Message:
ADS: queuing inpage-video-top-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1465)
Message:
ADS: queuing sharethrough-top-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1677)
Message:
ADS: queuing mpu-plus-top-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1781)
Message:
ADS: queuing dynamic-showcase-top-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 1788)
Message:
ADS: queuing mpu-middle-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 2015)
Message:
ADS: queuing mpu-bottom-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 2033)
Message:
ADS: queuing leader-plus-bottom-5d9b417217d4e for display
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_chartbeat_video
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_video
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api warning URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
VideoManager.initialize() did not receive a valid error callback function.
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
UVPJS 0.42.297 02/01/19 10:20:35 AM (PST)
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
[MUX] _initializePlugin
console-api log (Line 61)
Message:
blank creative loaded: 138239360957 (7 x 7, pos=nav)
console-api log (Line 61)
Message:
blank creative loaded: 43324823049 (728 x 90, pos=top)
console-api log (Line 61)
Message:
blank creative loaded: 138248164876 (300 x 250, pos=top)
console-api log (Line 61)
Message:
blank creative loaded: 138248164645 (300 x 250, pos=middle)
console-api log (Line 61)
Message:
blank creative loaded: 138239321475 (300 x 250, pos=bottom)
console-api log (Line 61)
Message:
blank creative loaded: 138239338545 (970 x 66, pos=bottom)
console-api warning URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8)
Message:
mPulse: Custom Timer 'video_ploaded' is not defined
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6)
Message:
********** register GGCMB
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6)
Message:
********** init GGCMB
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6)
Message:
********** register GLCFG
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6)
Message:
********** init GLCFG
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** register PLSTM
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** init PLSTM
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** register PLVBL
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** init PLVBL
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8)
Message:
********** register PLSIVT
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8)
Message:
********** init PLSIVT
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8)
Message:
********** register PLDPR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10)
Message:
********** init PLDPR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10)
Message:
********** register PLDCR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10)
Message:
********** init PLDCR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10)
Message:
********** init PLDPR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10)
Message:
********** init PLDCR
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** init PLVBL
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8)
Message:
********** init PLSIVT
console-api log URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7)
Message:
********** init PLSTM
console-api log (Line 61)
Message:
blank creative loaded: 138239375540 (372 x 142, pos=)
console-api log (Line 61)
Message:
blank creative loaded: 138239375180 (372 x 142, pos=)
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log (Line 61)
Message:
blank creative loaded: 138239344475 (11 x 11, pos=top)
console-api log (Line 61)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[15:54:46 GMT+0200 (Central European Summer Time).487] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed-in-cybercriminal-attacks/(Line 92)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c814.akstat.io
5f651e6f.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsadsales-a.akamaihd.net
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn-magiclinks.trackonomics.net
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
l.betrad.com
lightboxapi2.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
dw.cbsi.com
104.111.214.229
104.111.241.32
104.17.208.240
108.128.130.224
13.32.99.91
151.101.113.181
151.101.114.133
151.101.114.2
151.101.12.134
151.101.14.2
152.199.23.241
172.217.16.162
172.217.23.130
18.197.145.83
184.31.90.90
185.33.223.80
2.16.186.107
2.16.186.88
2.18.233.143
2.18.233.201
2.18.234.21
2.18.235.40
2.19.43.224
216.58.205.230
23.45.108.200
23.99.128.52
2600:9000:20ac:8800:1d:8c8c:47c0:93a1
2600:9000:20ac:9a00:18:1fcd:349:ca21
2600:9000:21f3:b800:2:42d9:3100:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4fa5
2606:4700::6810:50a5
2606:4700::6810:a00d
2a00:1288:110:c305::a000
2a00:1450:4001:800::2004
2a00:1450:4001:800::2006
2a00:1450:4001:806::2003
2a00:1450:4001:806::200a
2a00:1450:4001:814::2003
2a00:1450:4001:815::200e
2a00:1450:4001:81a::2003
2a00:1450:4001:81d::2002
2a00:1450:4001:81f::2001
2a01:4a0:1338:28::c38a:ff11
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:1b::621
2a04:4e42:3::444
3.225.45.120
3.248.168.38
3.85.71.249
34.205.11.82
34.250.208.218
34.252.62.73
35.157.160.140
35.190.38.167
35.190.72.21
35.227.208.151
52.18.214.98
52.20.62.87
52.48.237.210
52.56.89.170
54.159.171.100
54.171.105.8
64.30.230.22
66.117.28.68
66.117.28.86
99.80.15.126
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
01b9849922214670b387ade1904a0b76143ea147887b6197b21b4c1e1ff654c3
02da9066b91e23e312431d263cc1b6e0d13b06b7e0c6ded8b1363712d332d4e2
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd
03cdd154a67240548616e679dde7dd00a53bbfb48697a1635bafef7fd09406c4
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
0cae80c9382e2b3e8045ba09797fd66d1a65a936d70af2eed09897be81ea436e
0dec78b646458d7cb516d8b16a6b00d0b42e6585e9bd23d9a1e4f9d8aa0efbe8
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e3d11c4ef66b313ce0bd93d94e3a2060d4d5668e801cf919d9c087ce9e57e61
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea
0f33f072e8b10579a36622bc37a8ce983f16fe459e2a51dffbb9dd2f46eb137c
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11dea3c83c430d0de8ddeb8b5d46c309fe476723f645647b0a6dc0efbc3f6fd3
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
15102dc05e413115725f527ef7a26007562147b84910f3aa2b589d4ca52b114d
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
179d9e97f3d778f624821f22886ffa64e62e08b7a8d99cf2fec8051ed9449c0e
189bba7ba537adda81f5b419eb9233ee29da6cb4481711bfc6876be76f045f75
192a41b3a2ef7d13301354b3131babb5890472f61ebf9dbff4b461903ec719c6
198d338c5b5bad541dc19856972d15abf9d782fde423b460b4a7f89681c08d84
1996fb8b37fe4cf668c07fcdf89eedf167a0467acadbd5d177c078585232c745
1a5c80dfd13ceaa7f3053ebd95d6fdcca75db8c30100bb8ae7ec04204e4436d9
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1d6c3c621c4147594db5ca8ed0c57dbf3023fe6a75223c65fe38119741a31872
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df
1e799154a4de8bb8dc53bb9a5f06cdd0d38ee2ebb4c826c3b70914955d653127
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2561e72c62ab716f87767e67897b5c769b84eb71562c3cdd76950f7c14b4cd86
25ee8438325f726833afbcc7f75f152d9640156bda461c1b4636275af51c5dbe
26c58bf78d522c3e0150919a8aa7c9d8a7a252c762a3cc44eddd525c08ac7b1c
2b8a1a9cf77511e40cebbace9bc942fcea37e21bd48bdb2177a621e51ed383f0
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2f75b42863ee097e17a88d040e00155990f838d0c3f0c8ba64f024a6c5a0a44a
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
30da75fa42a0370a9eb050b016345bb9b1e0cd5d6c5047b7ac7f8fabb3bf86c2
30e6a91cdfc3de164d8be2d3ab96dfbbed50ffae0ba271161478748e2236dce0
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3598803978ce74966c652122fa1a6bff57db30f42052941f385fe0903aa12195
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
360460cb3af23a7f0ad56aeeda3f01a9e3f0215f3f8f4f01e86cfd15fb4f9d59
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
39a9055cfbe499fba4cdc4212910871b3a49af7c0e1a3c047294aa9c18c1b66a
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3b3d2e1a462539b0f2ae9310286eb7525e9c4c5f87e29140dbf3ea8b8b7db536
3c2981033b716002ee84bebb7f9bef2549566d98221d55e47dc30a1a4f633643
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805
3e7a5752fbc5eb7571f53132a305024cab6825bfaed3677a70c906b1ac47feb9
3f3437c0ee53d901590cb8b3526b726bcf713fded382662123e615f4159dee3a
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
412885350618a27cf29d952cf6edd470c828fab5005ce8f3d97b352a77e06299
41c195d9dc014931ef4c8baac01679b67e3e3b6f58508df9541b72528a1329e0
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
4b524ae7335a598c597e5cbc49711de64d45e485e54632ce5c7ddfc4e3c075f7
4b86140ebb1d1068c0451bcb05c80e8cbf9d3b184c666b2aece15ccd2ec4f837
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4c36e41bca3afb9243b837566da9e283ec9c73b639f9eb62fd4319f609b6addd
4cb8b95af340960b29e35ffdf555783853dadf7205e42174809aeeb0c38b6f66
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4d69c4f77d97653abc3b3ee46d3733e482966ee4d886711decf35a375fa22630
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
53cee335f89ac901c2af71c49498a7bf00e3f9aba9729ad6cc30527f95bc952b
5503ef6076611a5b5871f26582a57f30f11004a366e1da3eed377e760df5c597
5745383487c3952eea3e1897ef015b91ccd0b30b7400770b5c9000a9000225f9
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
585e68b616dc09fd14c7306595146b58e4f7178bd6d9397ccdb06035dcc90e6c
58c3593e62aeda27dc92790ddb33fd7ff8cfb0f7a9c154bc9ebad50afc2dd764
58c3a8b84bba035bda0914930d98472b686ac3c94a8dd3fda83cd261619dc89d
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a582fb4d43f615b09690329cd3322b639866d85cf403cf4863bd1df5588ffee
5a790924bbd7b891ef628a13280ec72f24b60c65c34c8ef9c7c16d60358975a5
5cc458e9d660cd459e46afabb10f499ad72e32e7ac5a786ac630de660f3279d7
5e08810ff7057c4c712c70508b6e823fe5e8391df08c1e54d1adac3d717d3740
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
6056ed3b6991fa938dfe44e00312c415a8b2db5869efdce6546f212983183698
60d67a916bedc4a537c42a443292a7cb19d05a6de88124020fb23d3ba94720fd
617bf7027ce458fe938f229d2e60f6b85ed5e38ab3a5bf65f39dae73179e60f4
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
645a9e0e0cd355bb6bbae04a4bb1146050bc76228360a4679f1f7af51b676322
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
67a2abf9c5f0456b687a94963dd4cf6643910c7093b086c29ce0937c3fc9b2de
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6c849673497b1b5c33c9a09e812aa0da912bc3564c30c1585ae151aa995e4e76
6d9c615cc0d9cb5db9b9abb42c4ec16521c9eb2911606cde4874402cf23882a0
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7c5e8ae97d184389610b4deeab367ea2bcbe2108fd50b622546240eadc847a89
7c7cbe8dfdb766a1ffdacb2de13f5bb889df31698565a8be5fb23c426596d4f1
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7fbfeaaaa646ba2dd49c23a6996d50ab1d941193ae390f6bd8cedef6db298951
809550c41585719adc4daedc11821c2645c63eedc50bad95cdfdb4232e2bd9d2
82d47a81e00e5a95607e27b7f3ec3ecff0c3c5e3eb159f80b122ac3770c8ac5b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85b3dae4b2262b0dbcb979a985a9e696d3100620e258b8b476522def349402fb
8712d548c2bf72289213c2eca9bcdd1e94c766bf9cf4653c422e91e07882f310
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d5a312a5ab9da7ef3231930eea712faa40cb7c56891ad6cc3b882335f1349f9
8e7e2d3d1771e4dc117eb74bf3d42c79b335c009d4726ce643887a3a53c5c18c
8ea829bfead62289894848e67f3fbc2fb4249e1d496aca395d96c2c3a5778a6f
8ec53f9bc47577505d655fdfc610cd320430d24193582b9f2b597be832ca810c
92441e9d3e45785e3b558bd6db3363dd99676eba60e2cbf47569e4cbbb658139
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
9343db07f0ec1e9c6ec54db33a8cb1778430a5ad3abbdc1f86d8989b8b9b44e5
93a1447e89af8b2c29a6344f2001e62601c8d168dd9f9996ea1bb06dc21dc68f
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9cfe765a0b23fc0698cf4c341ebae3daae61720c2100ffe69ef059639f8a3b0b
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
9f1b16bfc6f448a348f20c4fc091c1dd4d5a4c3838af60cb01c49522e3df76e6
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0846357a84bde9d83f32eff7da4622cda6456ff21ae9900628da7b9fafd398d
a0a377a73685e4b64df0f34d1121035a64553b075690bc46aa9aafdf4f4329ba
a0b64ceaecadf77483db282afd086e3567e5ef7a2618ae5544302e0c3d1e0685
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a55a460fd170ec232ea41c381757b6675909e1e657b597c5d99dcd344a1cccae
a55c8cbe529f4c1946ebd573323dd0adaab72dc8c2b74d88d7e8d801d81692f3
a74f45863d08ffe043bd57db4d0b836b72df249cc64b0e0c38346f8f318603a2
a7ef48cdd97935f47145d6b7a80a3ac8ddd2e7b73971a419a8efd5d0a550d468
a8dc3eb83d03ca9f155c527e3eb74da68c184e33ead202e5d60912b923270ce1
a91b3063e3d9f65e4445162917ae5ff4cd9914ef9fc1ff2e709c0b6d7da48724
ac862c10a86296fb7bcd912b8d7aad7e62a3f2325fe79d7e5ae726827caee3aa
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
ad094ec33835b32c304e47fb0b9e1698be7fd7c3909bd69c5a3476637c2d16ad
ad5896552117e82b7c344c695094d9fe6886891e229a213b669690d20917cb08
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
aebed54dc4bcd651a6da674de19cf434be4f80d66cb6bdcf63507bdc47c06149
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b
b23de91845b210d3e88e3f0662195f0d050e6325a3f25eb39a6069971d036b3a
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b55f0e65314298aa6644034ba593878fdaa54d2110c57c35857a46fa54361fab
b5bd040e94c4a87a1efe3d50ad481d5409fcf52d351fc070577299f2b9132d6b
b611ca52f1f37c5aefe7666a35b056a10b197ea00140d1189843961667c1bc0f
b76dd6ee844499da6d4848904e148e6ea19f800221b54e3bf6642c13de749d9a
b86f6fa61b5e9ced547beb544b2677cf3aaee7deffde1677105fbf6b94c82df8
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b98444965eb1324a4a140b4c67e8e633631b6eb9edac5dd38387a82e454352c5
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
bafb7f155a06996326a2d76d27e4470f8dd157370b390c2f4c281b210afc35d8
bc9560f50ec598538093147af28945c6117bf0b46e1571636f7e7c57ff2d5d79
bf069cddda8cd2b6740b460e576c56eaa88cc2e939d8d764b99fa4b87f26ffad
bf6221fb8bc8205f50c1e5c9e442a686aaf8606f67b30dc85a76f3e7d67b32a8
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c1f3bc0936afce66cb83467e1446ed5d74663c80fb40a33e8da9d98eba9df9fd
c29668f8a0bc99ad96beb8c89ad726ba073d26b211e370a8af0cd57ebfb36a44
c4b985401a0cb64b9e88935039dbfebd88c276c78603f1ff0b09288008afca20
c4df9500705d85c63296f2e32bd76bc5e733835801f150c7234f81f115a59e7b
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c7b5bf6afade0743dea9bc779c6e3be2a316c37efbe18b694d4c9e04b1318139
c7ef6d4f2b30bfc08b7cc935c0c06df95f32fcc757cf5803e65e90f3505e0e8d
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf759eb04f32815b2282dc5f89f818ed32c094760d82b4aebbd980e4c475aedf
cfcb9a7fdd096c0415e6facd33001be8ee0718fe0a0a365b755f10603445219d
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d86b322bbac503e6f32dbbd43e24a10ebed508c76c1b0e0e4b1e76868fba36d4
d9bddfba9cda4714a735ec84b0a89517be57b0e71cd2576db2ef5fab9181b3c9
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dd19af5895b698fd5945fa6ed945adaacde4d116f356a9cdfd7375dbbac4d540
dd4d1a01ff58cd429ad4dfe605df019c609e4bfca2cf6970b4dca4d2aa2e20a3
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c8c5266002e44c9001cf7a9dff6ae0957769e7b45122b4abe63f9311c90de9
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e6ce7cb65f2d52b79ccf0c4efa9c63ee4b6a43ab89631c768b25efbb3927272d
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7
e85ba4d66717e8de5dcba1b5e0285ced20874b84f316ff3c0840277352b9c9ea
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ec1101c6e14f7ded25b801aec3d1ee0ecb5515c7e2513e62a7d26afbd554834b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f0f5bba6d26e0cf209747e38fce1a81bd2f58ad415de6c17eabc2021d6ee4f7d
f1ee4eed540fc7f36bc9a6e509a151ff3e5c6531f0013cb211d92f887d67e0b5
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f2405e15e218da3c25783b6f2206344bec4d54426fc734ddcf97ba9926edeb58
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f7f2bdaa627c83bbf5853b182fa32d27f2876c431979080c783bb49e941bd44b
f8974adce797a671b36df4cd609c76eaf7d09c1c34330afdf75e0c5f3834cb9d
f8a7213020a4ec189f97f16583e6395ed0db2d48e1637f0f9862125c87f03808
f9230bd65b34ae73f879ddcf528ed530df0fee0dca551e23966aba2f3f8cf354
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fa418fc9669041ac1047f8acc1b90ee68e465e99e7d857d0eb2618401f15de7b
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5